statik icon indicating copy to clipboard operation
statik copied to clipboard

Add environment variables to context

Open kx-chen opened this issue 6 years ago • 1 comments

Add environment variables to context so they may be used in views.

Closes https://github.com/thanethomson/statik/issues/72

Alternatively, instead of passing all env variables in, I think statik could use an environment variable (maybe STATIK_ENV?) to determine the environment its running in, and only pass that variable to the context.

kx-chen avatar Dec 06 '18 10:12 kx-chen

I think it is necessary that the caller can prevent access to all environment variables, which may contain secrets.

A cmdline flag turning on this feature?

A cmdline flag listing the env vars which are allowed to be accessed?

A prefix, so only a subset of env vars are visible inside statik? i.e. STATIK_ENV allows only STATIK_ENV_FOO to be seen. This is the 'safest' in a netlify context, as a PR might modify netlify.toml and alter command line variables.

But worth keeping in mind everything is insecure in netlify deploy previews, as the requirements.txt could be changed to refer to a fork of statik, which allows any code modifications to bypass restrictions.

jayvdb avatar Dec 09 '18 02:12 jayvdb