Skip to content

Allow access to process#1

Open
andela-oakinniranye wants to merge 3 commits intozone-eu:masterfrom
andela-oakinniranye:oreoluwa/env
Open

Allow access to process#1
andela-oakinniranye wants to merge 3 commits intozone-eu:masterfrom
andela-oakinniranye:oreoluwa/env

Conversation

@andela-oakinniranye
Copy link

PS: i'm not sure of the most usecase here OR if this would be useful to anyone.

tbh, I'm not totally sure of the rationale behind sandboxing the configurations, but while working with the tool, I've found it a bit difficult to do a few things, e.g dynamically configure my database.
One of the 12factor best practices is to store configurations in the environment, but when the context of the environment is missing, it becomes a bit difficult to migrate things, especially when you want to keep things clean and don't want to ship any of dev config to prod, i.e. with config/production.js and config/development.js.
I'm not too sure of the most use case here, but I've found it easier to just allow access to the process(env, cwd etc) from the config. Although in the long run, i'd prefer the js config files not being placed within a sandboxed environment though.
As for security, like I've said I'm not totally sure of the most use case here, however if the purpose of the sandbox is to prevent a malicious attacker from gaining access, I think the purpose is probably already defeated if plugins are not loaded within the sandbox, because I'd assume any attacker that can launch within the context of the config, would probably already be able to launch anywhere else.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant