{"record":{"id":"51be2dcef408a572","repo":"mikefarah/yq","slug":"env-operations-have-been-disabled","errorCode":null,"errorMessage":"env operations have been disabled","messagePattern":"env operations have been disabled","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/yqlib/operator_env.go","lineNumber":21,"sourceCode":"import (\n\t\"container/list\"\n\t\"fmt\"\n\t\"os\"\n\t\"strings\"\n\n\tparse \"github.com/a8m/envsubst/parse\"\n)\n\ntype envOpPreferences struct {\n\tStringValue bool\n\tNoUnset     bool\n\tNoEmpty     bool\n\tFailFast    bool\n}\n\nfunc envOperator(_ *dataTreeNavigator, context Context, expressionNode *ExpressionNode) (Context, error) {\n\tif ConfiguredSecurityPreferences.DisableEnvOps {\n\t\treturn Context{}, fmt.Errorf(\"env operations have been disabled\")\n\t}\n\tenvName := expressionNode.Operation.CandidateNode.Value\n\tlog.Debugf(\"EnvOperator, env name: %v\", envName)\n\n\trawValue := os.Getenv(envName)\n\n\tpreferences := expressionNode.Operation.Preferences.(envOpPreferences)\n\n\tvar node *CandidateNode\n\tif preferences.StringValue {\n\t\tnode = &CandidateNode{\n\t\t\tKind:  ScalarNode,\n\t\t\tTag:   \"!!str\",\n\t\t\tValue: rawValue,\n\t\t}\n\t} else if rawValue == \"\" {\n\t\treturn Context{}, fmt.Errorf(\"value for env variable '%v' not provided in env()\", envName)\n\t} else {","sourceCodeStart":3,"sourceCodeEnd":39,"githubUrl":"https://github.com/mikefarah/yq/blob/8b5af0694bb82b41d4ae180fac9972029066f90a/pkg/yqlib/operator_env.go#L3-L39","documentation":"yq's `env` operator reads environment variables at evaluation time. For security, yq supports compiling/running with DisableEnvOps set (e.g. when processing untrusted input); when enabled, any use of `env(...)` is refused outright with this error. The library intentionally blocks environment access rather than silently returning empty values.","triggerScenarios":"Evaluating an expression containing `env(MY_VAR)` or `stenv` while the yq binary/pipeline was built or configured with ConfiguredSecurityPreferences.DisableEnvOps = true.","commonSituations":"Using a hardened yq build for CI on untrusted files; an embedder of the yqlib package set DisableEnvOps for safety; environment policy changed and older expressions using env() now fail.","solutions":["Remove env() usage from the expression and pass values via --from-file, arguments, or interpolated input","Rebuild/reconfigure yq with ConfiguredSecurityPreferences.DisableEnvOps = false if env access is trusted","Pre-resolve variables in the shell before invoking yq: MY=$(printenv MY) yq '.x = strenv(MY)' is also blocked — instead substitute literally","Contact whoever ships the hardened binary to confirm the policy before changing expressions"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"# detect a hardened build before running env-dependent expressions\nyq --version && grep -R 'DisableEnvOps' build-config/ || true","typeGuard":null,"tryCatchPattern":"out=$(yq '.x = env(TOKEN)' f.yaml 2>&1) || {\n  echo \"env ops unavailable, injecting value instead\" >&2\n  yq \".x = \\\"$TOKEN\\\"\" f.yaml\n}","preventionTips":["Keep expressions env-free for hardened builds; inject values as arguments","Document which yq builds in your CI disable env ops","Prefer passing secrets via files/args rather than env()"],"tags":["yq","security","environment"],"backgroundTag":"env-ops-disabled","analyzedSha":"8b5af0694bb82b41d4ae180fac9972029066f90a","analyzedAt":"2026-09-05T10:57:22.766Z","contentChangedAt":"2026-09-05T10:57:22.766Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}