Kong / Kong/insomnia

[Environment Variables] Functions/Tags inside nested block referring to another Environment Variable do not render variable value

Open
#3,919 2 comments 3 reactions 0 assignees View on GitHub
B-bug S-unverified
Dominant language
TypeScript
Stars
40k
Forks
2.4k
Avg merge
2d 13h
Merged PRs (30d)
61

Description

**Describe the bug**
When using Environment Variables, functions/tags inside a nested block referring to another Environment Variable that is constructed from an environment variable do not use the calculated variable value; instead the literal string is used. This only seems to impact functions, as direct references to these variables seem to still work.

**To Reproduce**
Steps to reproduce the behavior:
1. Go to Base Environments
1. Use this environment config:
```
{
"first_name": "Bobby",
"last_name": "'; DROP TABLES;'",
"full_name": "{{ _.first_name }} {{ _.last_name }}",
"baseEncodedRoot": "{% base64 'encode', 'normal', _.full_name %}",
"sub": {
"baseEncodedSub": "{% base64 'encode', 'normal', _.full_name %}",
"full_name": "{{_.full_name}}"
}
}
```
1. Mouse over both `_.baseEncodedRoot` and `_.sub.baseEncodedSub` tags and notice that they are both listed as having the same value.
1. Click Done to exit the Manage Environments
1. Create a new request
1. Add two parameters:
* base64EncodedRootName={{ _.baseEncodedRoot }}
* base64EncodedSubName={{ _.sub.baseEncodedSub }}
1. Click to preview/execute request
1. Notice the values in the parameters are different
1. Notice if you decode the base64 values, the root value is the calculated value (i.e., `Bobby '; DROP TABLES;'`; CORRECT), whereas the sub value is the literal string of the referenced value (i.e., `{{ _.first_name }} {{ _.last_name }}`; INCORRECT)

**Expected behavior**
Usage of a tag/function that refers to another variable that is constructed from other variables should be the same whether it is on the root or nested in a block.

**Screenshots**
![image](https://user-images.githubusercontent.com/30680/129673212-cde28656-9dd6-47bb-b074-e4c171878050.png)
![image](https://user-images.githubusercontent.com/30680/129673289-fd1d6663-a559-4c2d-aebb-a0290047ab99.png)
![image](https://user-images.githubusercontent.com/30680/129672830-69410a6b-a79c-46ac-999f-d9f30c0b6774.png)

**Desktop (please complete the following information):**
- OS: [e.g. macOS 10.15.1]
- Installation Method: [homebrew, built from source]
- App Version: Insomnia 2021.4.1
Release date: 7/6/2021
OS: Darwin x64 19.6.0
Electron: 9.3.5
Node: 12.14.1
V8: 8.3.110.13-electron.0
Architecture: x64
node-libcurl: libcurl/7.73.0 OpenSSL/1.1.1k zlib/1.2.11 brotli/1.0.9 zstd/1.4.9 libidn2/2.1.1 libssh2/1.9.0 nghttp2/1.42.0

**Additional context**
This was first discovered while using the Default Headers plugin to construct a header. After digging into things, I realized it wasn't an issue with the default headers plugin but has to do with the way the variables are being rendered outside the Manage Environments section.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the nested environment configuration from the issue and compare the root and nested function/tag rendering during request preview or execution. Trace how environment variables are resolved outside Manage Environments; done means both base64 values decode to the calculated full name rather than leaving the nested reference literal.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.