Environment variables starting with $ cause a recursion error

This SECRET_KEY declaration causes a maximum recursion depth exceeded error. (Note: I never used this secret key value anywhere since I was just starting the project)

SECRET_KEY = env("DJANGO_SECRET_KEY", default='$%ify^q7jg*o7(5me*g%+ae-7_1iy)gey*#eo%3c##-=1d=6mb')

Results in:

...snip...
  File "/Users/chromakey/.virtualenvs/xxxx/lib/python3.4/site-packages/environ/environ.py", line 260, in get_value
    value = self.get_value(value, cast=cast, default=default)
  File "/Users/chromakey/.virtualenvs/xxxx/lib/python3.4/site-packages/environ/environ.py", line 260, in get_value
    value = self.get_value(value, cast=cast, default=default)
  File "/Users/chromakey/.virtualenvs/xxxx/lib/python3.4/site-packages/environ/environ.py", line 249, in get_value
    value = os.environ[var]
  File "/Users/chromakey/.virtualenvs/xxxx/bin/../lib/python3.4/os.py", line 630, in __getitem__
    value = self._data[self.encodekey(key)]
RuntimeError: maximum recursion depth exceeded

This however, causes no error:

SECRET_KEY = env("DJANGO_SECRET_KEY", default='%ify^q7jg*o7(5me*g%+ae-7_1iy)gey*#eo%3c##-=1d=6mb')

Obviously not a blocker for me on anything, but thought I’d let you know. Thanks!

[mrogaski]

I just hit this bug, also while expanding SECRET_KEY.

I don’t think expansion should be applied to the value of environment variables at all. Frankly, it’s a significant security exposure.

Expansion using $FOO or ${FOO} in UN*X shells and %FOO% in Windows is done when setting the variables, but the variables are stored in their expanded form and are treated purely as opaque data by the shell when read and passed to the application. Expanding the values opens an application to a variety of parameter-tampering attacks, and I would argue that there’s really no legitimate use for such behavior in a 12-factor design.

[edmorley]

Another option would be to deprecate the current proxied value syntax $FOO and switch to something like ${FOO} which is much less likely to result in false positives when using random password generators.