Function interpolateEnvVars

src/utils/hooks/execHttpHook.ts:89–108

* Interpolate $VAR_NAME and ${VAR_NAME} patterns in a string using process.env, * but only for variable names present in the allowlist. References to variables * not in the allowlist are replaced with empty strings to prevent exfiltration * of secrets via project-configured HTTP hooks. * * The

(
  value: string,
  allowedEnvVars: ReadonlySet<string>,
)

 * The result is sanitized to strip CR/LF/NUL bytes to prevent header injection.
 */
function interpolateEnvVars(
  value: string,
  allowedEnvVars: ReadonlySet<string>,
): string {
  const interpolated = value.replace(
    /\$\{([A-Z_][A-Z0-9_]*)\}|\$([A-Z_][A-Z0-9_]*)/g,
    (_, braced, unbraced) => {
      const varName = braced ?? unbraced
      if (!allowedEnvVars.has(varName)) {
        logForDebugging(
          `Hooks: env var $${varName} not in allowedEnvVars, skipping interpolation`,
          { level: 'warn' },
        )
        return ''
      }
      return process.env[varName] ?? ''
    },
  )
  return sanitizeHeaderValue(interpolated)
}

/**
 * Execute an HTTP hook by POSTing the hook input JSON to the configured URL.