You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
No validation of project slug and environment slug existence before attempting to create secrets/variables
constenvironmentSlug=(awaittext({message: 'Enter the environment slug to import to:'}))asstringLogger.info(`Importing secrets and variables to project: ${projectSlug} and environment: ${environmentSlug} with default settings`)
const envVariables = dotenv.parse(envFileContent)
+if (Object.keys(envVariables).length === 0) {+ throw new Error('No environment variables found in the provided file')+}
const secretsAndVariables = secretDetector.detectObject(envVariables)
[Suggestion has been applied]
Suggestion importance[1-10]: 8
Why: This is a critical validation that prevents processing empty files and provides clear error feedback. Missing this check could lead to silent failures or unnecessary processing.
8
✅ Verify file existence before attempting to read its contents
Add file existence check before attempting to read the .env file to provide a clearer error message.
-const envFileContent = await fs.readFile(- path.resolve(dotEnvPath),- 'utf-8'-)+const resolvedPath = path.resolve(dotEnvPath)+const exists = await fs.access(resolvedPath).then(() => true).catch(() => false)+if (!exists) {+ throw new Error(`The .env file does not exist at path: ${resolvedPath}`)+}+const envFileContent = await fs.readFile(resolvedPath, 'utf-8')
[Suggestion has been applied]
Suggestion importance[1-10]: 7
Why: Important defensive programming practice that provides better error handling and user feedback when the .env file is missing, preventing cryptic filesystem errors.
7
Validate user input to prevent empty or invalid values
Add validation for the environment slug to ensure it's not empty or just whitespace.
const environmentSlug = (await text({
message: 'Enter the environment slug to import to:'
})) as string
+if (!environmentSlug?.trim()) {+ throw new Error('Environment slug cannot be empty')+}
Apply this suggestion
Suggestion importance[1-10]: 7
Why: Essential input validation that prevents potential issues with empty environment slugs, which could cause problems in downstream operations or database entries.
The reason will be displayed to describe this comment to others. Learn more.
I tried importing the env file. seems like anything that gets enclosed in "" gets detected as a variable. We need to strip values off "" before scanning
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![codiumai-pr-agent-free[bot]](https://avatars.githubusercontent.com/in/354216?s=60&v=4){kind=small}
User description
Description
@keyshade/secret-scan: Create a function to detect secrets and variables from JS object containing keys and values.cli: Add feature to import secrets and variables from .env file into Keyshade.Fixes #502
Fixes #503
Developer's checklist
If changes are made in the code:
Documentation Update
PR Type
Enhancement
Description
keyshade project importto import secrets and variables from .env filesdetectObjectfunction to analyze key-value pairsChanges walkthrough 📝
import.project.ts
Add import command for environment secrets and variablesapps/cli/src/commands/project/import.project.ts
index.ts
Add function to detect secrets from objectspackages/secret-scan/src/index.ts
detectObjectmethod to scan key-value pairsproject.command.ts
Register import command in project commandsapps/cli/src/commands/project.command.ts
index.d.ts
Add types for secret detection resultspackages/secret-scan/src/types/index.d.ts
detect-object.test.ts
Add tests for secret detection from objectspackages/secret-scan/src/test/detect-object.test.ts
package.json
Add dotenv package dependencyapps/cli/package.json