# Fix devcontainer localEnv/containerEnv substitution when variable is undefined \(\#53728\) · gitcafe/zed

[View on GitCafe](https://git.cafe/gitcafe/zed/commit/66a77d29fd4ede98f224c1a6b6cc5bc27d237366)

Repository: [gitcafe/zed](https://git.cafe/gitcafe/zed)

Visibility: public

Requested revision: 66a77d29fd4ede98f224c1a6b6cc5bc27d237366

Requested commit: 66a77d29fd4ede98f224c1a6b6cc5bc27d237366

Commit: 66a77d29fd4ede98f224c1a6b6cc5bc27d237366

Tree: f3d2c82d4cced572ebbc57268e998929c1f80001

Author: Ivan Mironov

Committer: GitHub

## Message

````
Fix devcontainer localEnv/containerEnv substitution when variable is undefined (#53728)

Existing code replaces only the variables that are present in the
environment. It ignores references to undefined variables and leaves
them as is.

Consider following devcontainer.json:

```json
{
  ...
  "remoteEnv": {
    "RUSTFLAGS": "${localEnv:RUSTFLAGS}"
  },
  ...
}
```

Existing code will set RUSTFLAGS inside the dev container to a correct
value only if RUSTFLAGS is defined outside the dev container. If
RUSTFLAGS is not defined outside, Zed will erroneously set RUSTFLAGS to
`${localEnv:RUSTFLAGS}`.

This patch fixes this by replacing such references with either empty
strings or provided default values (`${localEnv:VARNAME:default}`).

This patch also removes replacement of `\` with `/` for environment
variables. Existing code makes no sense as simple replacement will not
magically make Windows paths valid on *nix. It is also guaranteed to
break things: think about passing passwords via env vars, for example.

I also noticed that, for some reason, existing code serializes k-v maps
to JSON, then tries to replace the references, and after that
deserializes modified JSON back. I believe that this is horribly wrong
and may have some security implications. This is out of the scope of
this patch. And I hope that somebody from the Zed team will provide the
reasoning behind this code.

Self-Review Checklist:

- [X] I've reviewed my own diff for quality, security, and reliability
- [X] Unsafe blocks (if any) have justifying comments
- [X] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [X] Tests cover the new/changed behavior
- [X] Performance impact has been considered and is acceptable

~~Closes #ISSUE~~ This pull request is also a bug report.

Release Notes:

- Fixed substitution of `${localEnv:VARNAME}` and
`${containerEnv:VARNAME}` in devcontainer.json when variable is not
defined
````

## Parents

- [e18da9ef6d8019ac726e050d9b15cab931d9e738](https://git.cafe/gitcafe/zed/commit/e18da9ef6d8019ac726e050d9b15cab931d9e738?format=markdown)

[Source at this commit](https://git.cafe/gitcafe/zed/tree/66a77d29fd4ede98f224c1a6b6cc5bc27d237366?format=markdown)