Skip to content

Disallow direct env access#44

Merged
prabodh-panda merged 5 commits intomainfrom
disallow-direct-env-access
Jan 27, 2026
Merged

Disallow direct env access#44
prabodh-panda merged 5 commits intomainfrom
disallow-direct-env-access

Conversation

@prabodh-panda
Copy link
Member

Checklist

  • I have performed a self-review of my code.
  • I have made corresponding changes to the documentation.
  • I have added the necessary label (patch/minor/major - If package publish
    is required).
  • I have followed the suggested description format and styling.

Reviewers

@prabodh-panda prabodh-panda added backend Deals with Ruby & Rails code majorly. patch labels Jan 25, 2026
@neetodeploy neetodeploy bot temporarily deployed to rubocop-neeto-ljhq-pr-44 January 25, 2026 16:44 Inactive
Copy link

@neeto-bugwatch neeto-bugwatch bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 NeetoBugWatch Review

I've analyzed your pull request and found some potential improvements that might be worth considering. Please review the specific line comments below for helpful suggestions.

💡 To trigger a re-review of this PR, add a comment with the keyword neeto-bugwatch-run anywhere in the comment body.

(send (const {nil? cbase} :ENV) _ ...)
PATTERN

def on_send(node)

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using on_send catches explicit method calls like ENV['KEY'], but misses cases where ENV is aliased (e.g., x = ENV; x['KEY']) or passed as an argument. Consider implementing on_const to flag any usage of the ENV constant if strict prohibition is desired.

Copy link

@yedhink yedhink Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I feel this was a good review comment by NeetoBugWatch. I feel the following will be missed:

config = ENV
config['API_KEY']

do_something_with(ENV)

@prabodh-panda
Copy link
Member Author

@yedhink _a Can you please review?

Here is the demo: https://prabodh-kumar-panda.neetorecord.com/watch/8db62dfdfad28b313955

Copy link

@yedhink yedhink left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@prabodh-panda _a Have added one query. Once addressed go ahead and merge it.

(send (const {nil? cbase} :ENV) _ ...)
PATTERN

def on_send(node)
Copy link

@yedhink yedhink Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I feel this was a good review comment by NeetoBugWatch. I feel the following will be missed:

config = ENV
config['API_KEY']

do_something_with(ENV)

@neetogit-bot neetogit-bot bot assigned prabodh-panda and unassigned prabodh-panda and yedhink Jan 27, 2026
@neetodeploy neetodeploy bot temporarily deployed to rubocop-neeto-ljhq-pr-44 January 27, 2026 14:32 Inactive
@prabodh-panda prabodh-panda merged commit a188c2a into main Jan 27, 2026
1 check passed
@prabodh-panda prabodh-panda deleted the disallow-direct-env-access branch January 27, 2026 14:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backend Deals with Ruby & Rails code majorly. patch

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants