You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Currently the user-specified path could point to any folder and dotenv will parse them anyway even if it is files like /etc/passwd.
The content of the target file would be available in the error message. This could potentially introduce the path traversal vulnerability if the developer misuses it.
from dotenv import load_dotenv
from dotenv import dotenv_values
import os
config = dotenv_values("../../../etc/passwd")
I am wondering if it is possible to give dotenv_values an additional arguments to control if it would support relative path searching.
The text was updated successfully, but these errors were encountered:
nevercodecorrect
changed the title
Restrict the .env to the current project folder
Configure dotenv_values's search space
Mar 20, 2024
Currently the user-specified path could point to any folder and
dotenv
will parse them anyway even if it is files like/etc/passwd
.The content of the target file would be available in the error message. This could potentially introduce the path traversal vulnerability if the developer misuses it.
I am wondering if it is possible to give
dotenv_values
an additional arguments to control if it would support relative path searching.The text was updated successfully, but these errors were encountered: