
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
plover-local-env-var
Advanced tools
This Plover extension plugin contains a meta that can read in and output values stored in local environment variables on your computer.
Ever have information that is not quite secret enough to warrant putting in a password manager, but not public enough that you want to have steno dictionary outlines containing it available to the public? Information like your phone number, home address, and date of birth is very handy to have in outline values when filling in online forms etc, but I wouldn't want to share that info in my steno dictionaries.
So, in order to be able to share the outlines I use, but not the values contained in them, I put that kind of semi-secret information in environment variables, and use this plugin to access them in order to write them out.
[!NOTE] If you prefer to manually write out all your semi-secret information and/or you do not share your steno dictionaries publicly, you may not need to use this plugin at all.
[!WARNING] Please do not put secret information like passwords in your steno dictionary outlines! Plover stands between when you write your keystrokes and when they output on screen, fitting the very definition of a "man-in-the-middle" (see your
strokes.log
file for what Plover records by default). Use a password manager. If you use 1Password, you may find the Plover 1Password plugin of use to safely retrieve your passwords from your steno dictionary outlines.
Tools
menu, select Plugins Manager
).plover-local-env-var
Preferences...
)plover_local_env_var
to activate the pluginAfter defining and exporting environment variables in your shell
configuration file, you can use them in your outlines with the ENV_VAR
meta. For an environment variable named $PHONE_NUMBER
, the outline would look
like:
macOS or Linux
"{:ENV_VAR:$PHONE_NUMBER}"
Windows
"{:ENV_VAR:$ENV:PHONE_NUMBER}"
Pressing the "Disconnect and reconnect the machine" button on the Plover UI resets the environment variable cache. If you make any changes to the values contained in your environment variables, make sure to press it so they get re-read in again.
All the fetched values also get cached, so subsequent calls to the same env var get returned quicker.
Clone from GitHub with git:
git clone git@github.com:paulfioravanti/plover-local-env-var.git
cd plover-local-env-var
python -m pip install --editable ".[test]"
If you are a Tmuxinator user, you may find my plover_local_env_var project file of reference.
Plover's Python environment currently uses version 3.9 (see Plover's
workflow_context.yml
to confirm the current version).
So, in order to avoid unexpected issues, use your runtime version manager to make sure your local development environment also uses Python 3.9.x.
Currently, the only parts able to be tested are ones that do not rely directly on Plover.
Run tests, coverage, and linting with the following commands:
pytest --cov --cov-report=term-missing
pylint plover_local_env_var
mypy plover_local_env_var
To get a HTML test coverage report:
coverage run --module pytest
coverage html
open htmlcov/index.html
If you are a just
user, you may find the justfile
useful during
development in running multiple test commands. You can run the following command
from the project root directory:
just --working-directory . --justfile test/justfile
After making any code changes, deploy the plugin into Plover with the following command:
plover --script plover_plugins install --editable .
Where
plover
in the command is a reference to your locally installed version of Plover. See the Invoke Plover from the command line page for details on how to create that reference.
When necessary, the plugin can be uninstalled via the command line with the following command:
plover --script plover_plugins uninstall plover-local-env-var
FAQs
Use your local environment variables in Plover
We found that plover-local-env-var demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.