Harden environment lookup

This commit is contained in:
Shivam Mathur
2026-05-16 00:07:19 +05:30
parent 27b75bd953
commit b76777ed55
3 changed files with 18 additions and 9 deletions

View File

@@ -11,6 +11,12 @@ describe('Utils tests', () => {
expect(await utils.readEnv('TEST')).toBe('setup-php'); expect(await utils.readEnv('TEST')).toBe('setup-php');
expect(await utils.readEnv('test_hyphen')).toBe('setup-php'); expect(await utils.readEnv('test_hyphen')).toBe('setup-php');
expect(await utils.readEnv('TEST_HYPHEN')).toBe('setup-php'); expect(await utils.readEnv('TEST_HYPHEN')).toBe('setup-php');
expect(await utils.readEnv('test invalid')).toBe('');
process.env['conflict_hyphen'] = 'setup-php';
process.env['conflict-hyphen'] = 'wrong';
expect(await utils.readEnv('conflict_hyphen')).toBe('setup-php');
delete process.env['conflict_hyphen'];
delete process.env['conflict-hyphen'];
expect(await utils.readEnv('undefined')).toBe(''); expect(await utils.readEnv('undefined')).toBe('');
}); });

2
dist/index.js vendored

File diff suppressed because one or more lines are too long

View File

@@ -9,16 +9,19 @@ import * as fetch from './fetch';
* @param property * @param property
*/ */
export async function readEnv(property: string): Promise<string> { export async function readEnv(property: string): Promise<string> {
if (!/^[A-Za-z0-9_-]+$/.test(property)) {
return '';
}
const property_lc: string = property.toLowerCase(); const property_lc: string = property.toLowerCase();
const property_uc: string = property.toUpperCase(); const property_uc: string = property.toUpperCase();
return ( const candidates = [
process.env[property] || property,
process.env[property_lc] || property_lc,
process.env[property_uc] || property_uc,
process.env[property_lc.replace('_', '-')] || property_lc.replace('_', '-'),
process.env[property_uc.replace('_', '-')] || property_uc.replace('_', '-')
'' ].filter((value, index, array) => array.indexOf(value) === index);
); return candidates.map(name => process.env[name] || '').find(Boolean) || '';
} }
/** /**