env.go RawHistoryFolder

1package domain
2
3import (
4	"regexp"
5	"strings"
6)
7
8var (
9	envKeyRegex    = regexp.MustCompile(`^[A-Za-z_][A-Za-z0-9_]*$`)
10	secretRefRegex = regexp.MustCompile(`\$\{(pass|sops):[^}]+\}`)
11)
12
13// ValidateEnvKey validates an env key for storage.
14func ValidateEnvKey(key string) error {
15	if key == "" {
16		return ErrInvalidEnvKey
17	}
18	if strings.Contains(key, "..") || strings.ContainsAny(key, "/\\") {
19		return ErrPathTraversal
20	}
21	if !envKeyRegex.MatchString(key) {
22		return ErrInvalidEnvKey
23	}
24	return nil
25}
26
27// ContainsSecretReference detects if a string contains a secret provider reference
28// like ${pass:path} or ${sops:path}. This is used to prevent attacker-controlled
29// env files from persisting secret references that would later resolve against
30// host secret providers.
31func ContainsSecretReference(value string) bool {
32	return secretRefRegex.MatchString(value)
33}