CONFIG_FORCE_: Environment variables appear twice in Configuration

[GMShuhr]

(This issue is a copy of Play Issue 10206 but was opened here again, since it is not really a Play issue)

Config Version:

1.4.0 (according to the JAR file name)

Play Version

2.8.1

API

Scala 2.12.8

Operating System

MacOS 10.15.4

JDK

java version "1.8.0_171"
Java(TM) SE Runtime Environment (build 1.8.0_171-b11)
Java HotSpot(TM) 64-Bit Server VM (build 25.171-b11, mixed mode)

Expected Behavior

1. Define an environment variable (e.g. CONFIG_FORCE_dummy_foo_bar=1) on the command line according to the naming scheme described in the systemEnvironmentOverrides Javadoc
2. Start sbt from command line with the option -Dconfig.override_with_env_vars=true to enable system environment overrides
3. In the running application, get the Configuration object (e.g. by dependency injection)
4. The entry "dummy.foo.bar" with value "1" should be found in the Configuration object.
5. The entry "CONFIG_FORCE_dummy_foo_bar" (i.e. the original name of the environment variable) should NOT be found in the configuration.

Actual Behavior

1. Define an environment variable (e.g. CONFIG_FORCE_dummy_foo_bar=1) on the command line according to the naming scheme described in the systemEnvironmentOverrides Javadoc
2. Start sbt from command line with the option -Dconfig.override_with_env_vars=true to enable system environment overrides
3. In the running application, get the Configuration object (e.g. by dependency injection)
4. The entry "dummy.foo.bar" with value "1" is found in the Configuration object.
5. The entry "CONFIG_FORCE_dummy_foo_bar" (i.e. the original name of the environment variable) with the same value IS ALSO found in the Configuration object.
6. Also any other environment variable existing at startup time whether it starts with "CONFIG_FORCE_" or not is found in the Configuration object.

The appearance of unwanted values in the Configuration object can lead to all kinds of problems, starting with name collisions and security and privacy issues.

The cause of the problem seems to be the implementation of com.typesafe.config.impl.ConfigImpl.loadEnvVariablesOverrides():

The "result" map gets initialized with all the original environment variables

Map<String, String> result = new HashMap(System.getenv());

It should instead be initialized to an empty map and only be filled by the loop following in the code.

[mkurz]

@havocp This issue can be closed, it was fixed in #686 already.