[Environment Variables] Functions/Tags inside nested block referring to another Environment Variable do not render variable value
- Dominant language
- TypeScript
- Stars
- 40k
- Forks
- 2.4k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 61
Description
**Describe the bug**
When using Environment Variables, functions/tags inside a nested block referring to another Environment Variable that is constructed from an environment variable do not use the calculated variable value; instead the literal string is used. This only seems to impact functions, as direct references to these variables seem to still work.
**To Reproduce**
Steps to reproduce the behavior:
1. Go to Base Environments
1. Use this environment config:
```
{
"first_name": "Bobby",
"last_name": "'; DROP TABLES;'",
"full_name": "{{ _.first_name }} {{ _.last_name }}",
"baseEncodedRoot": "{% base64 'encode', 'normal', _.full_name %}",
"sub": {
"baseEncodedSub": "{% base64 'encode', 'normal', _.full_name %}",
"full_name": "{{_.full_name}}"
}
}
```
1. Mouse over both `_.baseEncodedRoot` and `_.sub.baseEncodedSub` tags and notice that they are both listed as having the same value.
1. Click Done to exit the Manage Environments
1. Create a new request
1. Add two parameters:
* base64EncodedRootName={{ _.baseEncodedRoot }}
* base64EncodedSubName={{ _.sub.baseEncodedSub }}
1. Click to preview/execute request
1. Notice the values in the parameters are different
1. Notice if you decode the base64 values, the root value is the calculated value (i.e., `Bobby '; DROP TABLES;'`; CORRECT), whereas the sub value is the literal string of the referenced value (i.e., `{{ _.first_name }} {{ _.last_name }}`; INCORRECT)
**Expected behavior**
Usage of a tag/function that refers to another variable that is constructed from other variables should be the same whether it is on the root or nested in a block.
**Screenshots**



**Desktop (please complete the following information):**
- OS: [e.g. macOS 10.15.1]
- Installation Method: [homebrew, built from source]
- App Version: Insomnia 2021.4.1
Release date: 7/6/2021
OS: Darwin x64 19.6.0
Electron: 9.3.5
Node: 12.14.1
V8: 8.3.110.13-electron.0
Architecture: x64
node-libcurl: libcurl/7.73.0 OpenSSL/1.1.1k zlib/1.2.11 brotli/1.0.9 zstd/1.4.9 libidn2/2.1.1 libssh2/1.9.0 nghttp2/1.42.0
**Additional context**
This was first discovered while using the Default Headers plugin to construct a header. After digging into things, I realized it wasn't an issue with the default headers plugin but has to do with the way the variables are being rendered outside the Manage Environments section.
Contributor guide
Research direction
Start by reproducing the nested environment configuration from the issue and compare the root and nested function/tag rendering during request preview or execution. Trace how environment variables are resolved outside Manage Environments; done means both base64 values decode to the calculated full name rather than leaving the nested reference literal.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100