Skip to content

dotenv: strip leading UTF-8 BOM in parseEnv and --env-file - #67132

Open
helmipradita wants to merge 1 commit into
nodejs:mainfrom
helmipradita:fix/dotenv-strip-leading-utf8-bom
Open

helmipradita wants to merge 1 commit into
nodejs:mainfrom
helmipradita:fix/dotenv-strip-leading-utf8-bom

Conversation

@helmipradita

Copy link
Copy Markdown

Fixes #67102

Checklist
  • make -j4 test (UNIX), or vcbuild test (Windows) passes
  • tests and/or benchmarks are included
  • commit message follows commit guidelines
Description of change

Files beginning with a UTF-8 Byte Order Mark (\xEF\xBB\xBF) are common on Windows (such as those generated by PowerShell 5.1 Set-Content -Encoding utf8 or Notepad's "UTF-8 with BOM").

Previously, Dotenv::ParseContent in src/node_dotenv.cc removed \r characters but did not strip a leading UTF-8 BOM, resulting in the BOM remaining attached to the first key (e.g. \uFEFFA instead of A). Consequently, the first environment variable was inaccessible via its expected name under process.env.

This PR strips a leading UTF-8 BOM (\xEF\xBB\xBF) from content if present at index 0 and adds a test asserting that util.parseEnv correctly strips the leading BOM.

@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/config

@nodejs-github-bot nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. config Issues and PRs related to Node.js configuration and feature settings. needs-ci PRs that need a full CI run. labels Oct 30, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Welcome to Node.js, and thank you for your first contribution!

Before review, please take a moment to read:

Please make sure every commit is signed off. For a first pull request, GitHub Actions require collaborator approval and Jenkins CI must be started by a collaborator or triager, so an initial wait is normal.

Caution

AgentScan found account activity patterns that may be consistent with automation. This is a heuristic, not proof that this pull request was opened by an agent or violates policy. AI-assisted contributions are permitted, but automated tooling must not open pull requests without advance approval, and contributors must personally understand, test, verify, and take responsibility for every submitted change. See the AgentScan analysis, AI use policy, and automation policy for additional context.

Fixes: nodejs#67102

Files starting with a UTF-8 Byte Order Mark (\xEF\xBB\xBF) are common on
Windows. Previously, Dotenv::ParseContent did not strip a leading BOM,
leaving it attached to the first key and corrupting process.env access.

Strip a leading UTF-8 BOM if present at the beginning of content and add
a test case in test-util-parse-env.js.

Signed-off-by: Helmi Pradita <50313181+helmipradita@users.noreply.github.com>
@helmipradita
helmipradita force-pushed the fix/dotenv-strip-leading-utf8-bom branch from 2916cb7 to 650b51a Compare October 30, 2026 06:51
@helmipradita

Copy link
Copy Markdown
Author

Regarding the AgentScan flag: this PR is personally authored and manually prepared following issue #67102.

The commit message and metadata have also been updated to strictly comply with Node.js guidelines (valid subsystem, line length <= 72, and Signed-off-by trailer).

@MikeMcC399

This comment was marked as resolved.

@helmipradita

Copy link
Copy Markdown
Author

Understood, thank you for the reminder and context @MikeMcC399! I will hold off on opening any new PRs in Node.js until these are reviewed and landed.

@codecov

codecov Bot commented Nov 8, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.68%. Comparing base (502c117) to head (650b51a).
⚠️ Report is 110 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main   #67132      +/-   ##
==========================================
+ Coverage   90.66%   90.68%   +0.01%     
==========================================
  Files         797      797              
  Lines      278791   278794       +3     
  Branches    53620    53616       -4     
==========================================
+ Hits       252768   252820      +52     
+ Misses      16376    16339      -37     
+ Partials     9647     9635      -12     
Files with missing lines Coverage Δ
src/node_dotenv.cc 84.97% <100.00%> (+0.21%) ⬆️

... and 32 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

agentscan:automated-account c++ Issues and PRs that require attention from people who are familiar with C++. config Issues and PRs related to Node.js configuration and feature settings. needs-ci PRs that need a full CI run.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

util.parseEnv and --env-file keep a leading UTF-8 BOM in the first key

3 participants