@@ -1,5 +1,6 @@
11import fs from "node:fs/promises";
22import path from "node:path";
3+import { normalizeEnvVarKey } from "../infra/host-env-security.js";
34import {
45normalizeLowercaseStringOrEmpty,
56normalizeOptionalString,
@@ -12,8 +13,10 @@ import {
1213resolveSystemNodePath,
1314} from "./runtime-paths.js";
1415import { getMinimalServicePathPartsFromEnv } from "./service-env.js";
16+import { SERVICE_PROXY_ENV_KEYS } from "./service-env.js";
1517import {
1618collectInlineManagedServiceEnvKeys,
19+hasInlineEnvironmentSource,
1720isEnvironmentFileOnlySource,
1821} from "./service-managed-env.js";
1922import type { GatewayServiceEnvironmentValueSource } from "./service-types.js";
@@ -47,6 +50,7 @@ export const SERVICE_AUDIT_CODES = {
4750gatewayPathNonMinimal: "gateway-path-nonminimal",
4851gatewayTokenEmbedded: "gateway-token-embedded",
4952gatewayManagedEnvEmbedded: "gateway-managed-env-embedded",
53+gatewayProxyEnvEmbedded: "gateway-proxy-env-embedded",
5054gatewayTokenMismatch: "gateway-token-mismatch",
5155gatewayRuntimeBun: "gateway-runtime-bun",
5256gatewayRuntimeNodeVersionManager: "gateway-runtime-node-version-manager",
@@ -260,6 +264,66 @@ function auditManagedServiceEnvironment(
260264});
261265}
262266267+function normalizeServiceEnvKey(key: string): string | null {
268+return normalizeEnvVarKey(key, { portable: true })?.toUpperCase() ?? null;
269+}
270+271+function readEnvironmentValueSource(
272+command: GatewayServiceCommand,
273+normalizedKey: string,
274+): GatewayServiceEnvironmentValueSource | undefined {
275+for (const [rawKey, source] of Object.entries(command?.environmentValueSources ?? {})) {
276+if (normalizeServiceEnvKey(rawKey) === normalizedKey) {
277+return source;
278+}
279+}
280+return undefined;
281+}
282+283+const SERVICE_PROXY_ENV_KEY_SET = new Set(
284+SERVICE_PROXY_ENV_KEYS.flatMap((key) => {
285+const normalized = normalizeServiceEnvKey(key);
286+return normalized ? [normalized] : [];
287+}),
288+);
289+290+function collectInlineProxyEnvKeys(command: GatewayServiceCommand): string[] {
291+if (!command?.environment) {
292+return [];
293+}
294+const inlineKeys: string[] = [];
295+for (const [rawKey, value] of Object.entries(command.environment)) {
296+if (typeof value !== "string" || !value.trim()) {
297+continue;
298+}
299+const normalized = normalizeServiceEnvKey(rawKey);
300+if (!normalized || !SERVICE_PROXY_ENV_KEY_SET.has(normalized)) {
301+continue;
302+}
303+if (!hasInlineEnvironmentSource(readEnvironmentValueSource(command, normalized))) {
304+continue;
305+}
306+inlineKeys.push(normalized);
307+}
308+return [...new Set(inlineKeys)].toSorted();
309+}
310+311+function auditProxyServiceEnvironment(
312+command: GatewayServiceCommand,
313+issues: ServiceConfigIssue[],
314+) {
315+const inlineKeys = collectInlineProxyEnvKeys(command);
316+if (inlineKeys.length === 0) {
317+return;
318+}
319+issues.push({
320+code: SERVICE_AUDIT_CODES.gatewayProxyEnvEmbedded,
321+message: "Gateway service embeds proxy environment values that should not be persisted.",
322+detail: `inline keys: ${inlineKeys.join(", ")}`,
323+level: "recommended",
324+});
325+}
326+263327export function readEmbeddedGatewayToken(command: GatewayServiceCommand): string | undefined {
264328if (!command) {
265329return undefined;
@@ -463,6 +527,7 @@ export async function auditGatewayServiceConfig(params: {
463527464528auditGatewayCommand(params.command?.programArguments, issues);
465529auditManagedServiceEnvironment(params.command, issues, params.expectedManagedServiceEnvKeys);
530+auditProxyServiceEnvironment(params.command, issues);
466531auditGatewayToken(params.command, issues, params.expectedGatewayToken);
467532auditGatewayServicePath(params.command, issues, params.env, platform);
468533await auditGatewayRuntime(params.env, params.command, issues, platform);
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。