Skip to content

Unconditional use of process.env.* errors in sandboxes such as the Slack deno runtime #179

@NickCrews

Description

@NickCrews

Steps to reproduce

I want to use this library in the slack deno sdk. But, slack hosts your code for you, and runs it in a sandboxed deno runtime. One of the restrictions they place is they disallow access to process.env.

I am getting this error when doing the basic hello world:

import { neon } from '@neondatabase/serverless';
const sql = neon(process.env.DATABASE_URL);
const result = await sql`SELECT * FROM table WHERE id = ${1}`;
Caught error from user supplied module: NotCapable: Requires env access to "USER", run again with the --allow-env flag
            at Object.getEnv [as get] (ext:deno_os/30_os.js:124:10)
            at denoEnvGet (ext:deno_node/_process/process.ts:27:21)
            at Object.get (ext:deno_node/_process/process.ts:44:22)
            at file:///var/task/functions/agent_capn.js:52659:59
            at file:///var/task/functions/agent_capn.js:50088:31
            at file:///var/task/functions/agent_capn.js:52696:32
            at file:///var/task/functions/agent_capn.js:50088:31
            at file:///var/task/functions/agent_capn.js:54977:13

It looks to me like this is caused by

serverless/src/client.ts

Lines 48 to 64 in 2c51902

// throw on likely missing DB connection params
const hasConfiguredHost =
(typeof this.config !== 'string' && this.config?.host !== undefined) ||
(typeof this.config !== 'string' &&
this.config?.connectionString !== undefined) ||
process.env.PGHOST !== undefined;
const defaultUser = process.env.USER ?? process.env.USERNAME;
if (
!hasConfiguredHost &&
this.host === 'localhost' &&
this.user === defaultUser &&
this.database === defaultUser &&
this.password === null
)
throw new Error(
`No database host or connection string was set, and key parameters have default values (host: localhost, user: ${defaultUser}, db: ${defaultUser}, password: null). Is an environment variable missing? Alternatively, if you intended to connect with these parameters, please set the host to 'localhost' explicitly.`,
);

We try to access the process.env even though I have passed the connection string so all the params have been set.
Instead, can we make it so that we only try to access process.env if we NEED to? Since I passed a connection string, we should be able to avoid accessing process.env entirely.

This looks to me like the only place we access process.env, so with this fix hopefully this will run on slack's infra, which would be really cool, I can have an text to SQL agent right in slack's environment :)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions