# Excluding env vars

**URL:** <https://discourse.nodered.org/t/excluding-env-vars/92497>\
**Category:** General\
**Created:** [18 October 2024 13:44 UTC](https://discourse.nodered.org/t/excluding-env-vars/92497 "2024-10-18T13:44:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![bubson](https://avatars.discourse-cdn.com/v4/letter/b/bbe5ce/32.png) [@bubson](https://discourse.nodered.org/u/bubson)\
**Post date:** [18 October 2024 13:44 UTC](https://discourse.nodered.org/t/excluding-env-vars/92497/1 "2024-10-18T13:44:17Z")

</div>

Hi,  
I can use "envVarExcludes" key in settings.js to exclude some env variables that i do not want to be present in node-red.  
This is handled in @node-red/runtime/lib/flows/util.js

However inside function node I can get it like:  
`msg.payload=RED.util.getSetting(null, "MY_SECRET_ENV", null)`

That`s becouse there is no protecion in this part of code: [@node-red/util/lib/util.js](https://github.com/node-red/node-red/blob/2854351909dee9f92597faba3f37239134294eec/packages/node_modules/%40node-red/util/lib/util.js#L535)

Shouldn`t it be also protected?

Another question, would it be possible to have a setting that allow to remove RED.util from function node sandbox?

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [18 October 2024 14:29 UTC](https://discourse.nodered.org/t/excluding-env-vars/92497/2 "2024-10-18T14:29:23Z")

</div>

Hi @bubson

Please raise an issue on github with the details so we can address it: [Issues · node-red/node-red · GitHub](https://github.com/node-red/node-red/issues)

> [@bubson](#):
>
> Another question, would it be possible to have a setting that allow to remove RED.util from function node sandbox?

Can you expand on why you'd want that removed? The Function node sandbox isn't a fully secure sandbox; there are ways it can be circumvented if you are familiar enough with JavaScript. At best, it provides some guard rails by not making the full node.js environment readily available.

---

<div class="post-metadata">

**Author:** ![bubson](https://avatars.discourse-cdn.com/v4/letter/b/bbe5ce/32.png) [@bubson](https://discourse.nodered.org/u/bubson)\
**Post date:** [18 October 2024 23:20 UTC](https://discourse.nodered.org/t/excluding-env-vars/92497/3 "2024-10-18T23:20:41Z")

</div>

@knolleary  
I see your point of view.  
So I have another question. One thing is that there is possibility of escaping function node sandbox context.  
Second - knowing that "vm" module is "exploitable" in a way that there is possibility to execute any code like for example you can install npm modules that are dissalowed in settings. (I know that much more "harmfull things" can be done) Do you have any plans to redesign function node in future? Or it will be left as is?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [16 January 2025 23:21 UTC](https://discourse.nodered.org/t/excluding-env-vars/92497/4 "2025-01-16T23:21:13Z")

</div>

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.