Kong / insomnia

The open-source, cross-platform API client for GraphQL, REST, WebSockets, SSE and gRPC. With Cloud, Local and Git storage.
https://insomnia.rest
Apache License 2.0
34.84k stars 1.97k forks source link

[Environment Variables] Functions/Tags inside nested block referring to another Environment Variable do not render variable value #3919

Open bbbco opened 3 years ago

bbbco commented 3 years ago

Describe the bug When using Environment Variables, functions/tags inside a nested block referring to another Environment Variable that is constructed from an environment variable do not use the calculated variable value; instead the literal string is used. This only seems to impact functions, as direct references to these variables seem to still work.

To Reproduce Steps to reproduce the behavior:

  1. Go to Base Environments
  2. Use this environment config:
    {
    "first_name": "Bobby",
    "last_name": "'; DROP TABLES;'",
    "full_name": "{{ _.first_name }} {{ _.last_name }}",
    "baseEncodedRoot": "{% base64 'encode', 'normal', _.full_name %}",
    "sub": {
    "baseEncodedSub": "{% base64 'encode', 'normal', _.full_name %}",
    "full_name": "{{_.full_name}}"
    }
    }
  3. Mouse over both _.baseEncodedRoot and _.sub.baseEncodedSub tags and notice that they are both listed as having the same value.
  4. Click Done to exit the Manage Environments
  5. Create a new request
  6. Add two parameters:
    • base64EncodedRootName={{ _.baseEncodedRoot }}
    • base64EncodedSubName={{ _.sub.baseEncodedSub }}
  7. Click to preview/execute request
  8. Notice the values in the parameters are different
  9. Notice if you decode the base64 values, the root value is the calculated value (i.e., Bobby '; DROP TABLES;'; CORRECT), whereas the sub value is the literal string of the referenced value (i.e., {{ _.first_name }} {{ _.last_name }}; INCORRECT)

Expected behavior Usage of a tag/function that refers to another variable that is constructed from other variables should be the same whether it is on the root or nested in a block.

Screenshots image image image

Desktop (please complete the following information):

Additional context This was first discovered while using the Default Headers plugin to construct a header. After digging into things, I realized it wasn't an issue with the default headers plugin but has to do with the way the variables are being rendered outside the Manage Environments section.

bbbco commented 3 years ago

Same thing happens if you try to do the function calculation in the root variable and refer to it in the nested object. For example:

{
  "first_name": "Bobby",
  "last_name": "'; DROP TABLES;'",
  "full_name": "{{ _.first_name }} {{ _.last_name }}",
  "baseEncodedRoot": "{% base64 'encode', 'normal', _.full_name %}",
  "sub": {
    "baseEncodedSub": "{{_.baseEncodedRoot}}"
  }
}

_.baseEncodedRoot is calculated correctly. However, _.sub.baseEncodedSub is not (the base64 function uses the literal {{ _.first_name }} {{ _.last_name }})


Also, this is not just relegated to the Base64 function. This can be swapped out for one of the hashing functions with the same results.

bbbco commented 2 years ago

This also seems to only occur on the Base Environment; the variable is rendered correctly when a Sub Environment is selected.