Security: special-key variable names (toString/constructor/hasOwnProperty) not filtered in parseEnvAST

[Nick-730]

Security: special-key variable names (toString/constructor/hasOwnProperty) not filtered in parseEnvAST

Package: @tokey/env-file-parser@2.0.0 (monorepo: packages/env-file-parser)
Severity: Medium (logic corruption / potential DoS in consumers)
Type: Special key handling in parser output

Summary

In parseEnvAST, variables are written into the result object without filtering special keys. An .env file containing keys like toString, valueOf, hasOwnProperty, or constructor overwrites those built-in methods on the returned variables object with string values. Consumers that rely on these methods (template interpolation, hasOwnProperty checks, constructor-based logic) will crash or misbehave.

Location

packages/env-file-parser/src/env-parser.ts — the variables[key] = value assignment (compiled: dist/env-parser.js:183):

if (key) {
    variables[key] = value;   // ← no filtering of __proto__/constructor/toString/hasOwnProperty
}

Proof of concept

const { parseEnvAST } = require('@tokey/env-file-parser')

const ast = parseEnvAST('APP_NAME=MyApp\ntoString=EVIL\nhasOwnProperty=nope\nconstructor=evil\n')
console.log(ast.variables)
// { APP_NAME: 'MyApp', toString: 'EVIL', hasOwnProperty: 'nope', constructor: 'evil' }

console.log(typeof ast.variables.toString)   // "string" — was a function
console.log(typeof ast.variables.hasOwnProperty)  // "string"
console.log(typeof ast.variables.constructor)     // "string"

// Consumer crash example:
// ast.variables.hasOwnProperty('APP_NAME')  →  TypeError: ast.variables.hasOwnProperty is not a function

Suggested fix

Filter dangerous keys before assignment, or use a null-prototype object (Object.create(null)) for variables:

const variables = Object.create(null);
// and/or:
if (key === '__proto__' || key === 'constructor' || key === 'prototype' ||
    key === 'toString' || key === 'valueOf' || key === 'hasOwnProperty') {
    continue;
}

Notes

• __proto__=stringvalue does not pollute the global Object.prototype (JS __proto__ setter rejects non-object values), so no RCE — impact is limited to method overwrite on the result object.
• The same issue exists in the unrelated package env-file-parser (different author, lib/parse.js:32), suggesting this is a systemic gap in .env parsers.
• Attack surface: .env content can be influenced via shared config templates, CI injection, or supply-chain (a dependency writing .env at install time).