Function UserSecretEnvNameValid

codersdk/usersecretvalidation.go:232–265

UserSecretEnvNameValid validates an environment variable name for a user secret. Empty string is allowed (means no env injection).

(s string)

// UserSecretEnvNameValid validates an environment variable name for
// a user secret. Empty string is allowed (means no env injection).
func UserSecretEnvNameValid(s string) error {
	if s == "" {
		return nil
	}

	if len(s) > MaxUserSecretEnvNameLength {
		return xerrors.Errorf(
			"environment variable name must not exceed %d bytes",
			MaxUserSecretEnvNameLength,
		)
	}

	if !posixEnvNameRegex.MatchString(s) {
		return xerrors.New("must start with a letter or underscore, followed by letters, digits, or underscores")
	}

	upper := strings.ToUpper(s)

	if _, ok := reservedEnvNames[upper]; ok {
		return xerrors.Errorf("%s is a reserved environment variable name", upper)
	}

	if upper == "CODER" || strings.HasPrefix(upper, "CODER_") {
		return xerrors.New("environment variable names starting with CODER_ are reserved for internal use")
	}

	for _, prefix := range reservedEnvPrefixes {
		if strings.HasPrefix(upper, prefix) {
			return xerrors.Errorf("environment variables starting with %s are reserved", prefix)
		}
	}

	return nil
}

// UserSecretFilePathValid validates a file path for a user secret.
// Empty string is allowed (means no file injection). Non-empty paths