Skip to content

fix: handle potentially undefined env variables in nginx template #41648

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
leno23 wants to merge 1 commit into
base: release
Choose a base branch
from
+38 −19
Open

fix: handle potentially undefined env variables in nginx template #41648

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
57 changes: 38 additions & 19 deletions app/client/docker/templates/nginx-app.conf.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,26 +27,45 @@ server {
sub_filter_once off;
location / {
proxy_pass __APPSMITH_CLIENT_PROXY_PASS__;
sub_filter __APPSMITH_SENTRY_DSN__ '${APPSMITH_SENTRY_DSN}';
sub_filter __APPSMITH_SMART_LOOK_ID__ '${APPSMITH_SMART_LOOK_ID}';
sub_filter __APPSMITH_SEGMENT_KEY__ '${APPSMITH_SEGMENT_KEY}';
sub_filter __APPSMITH_CLIENT_LOG_LEVEL__ '${APPSMITH_CLIENT_LOG_LEVEL}';
sub_filter __APPSMITH_SENTRY_RELEASE__ '${APPSMITH_SENTRY_RELEASE}';
sub_filter __APPSMITH_SENTRY_ENVIRONMENT__ '${APPSMITH_SENTRY_ENVIRONMENT}';
sub_filter __APPSMITH_VERSION_ID__ '${APPSMITH_VERSION_ID}';
sub_filter __APPSMITH_VERSION_RELEASE_DATE__ '${APPSMITH_VERSION_RELEASE_DATE}';
sub_filter __APPSMITH_INTERCOM_APP_ID__ '${APPSMITH_INTERCOM_APP_ID}';
sub_filter __APPSMITH_MAIL_ENABLED__ '${APPSMITH_MAIL_ENABLED}';
sub_filter __APPSMITH_RECAPTCHA_SITE_KEY__ '${APPSMITH_RECAPTCHA_SITE_KEY}';
sub_filter __APPSMITH_DISABLE_INTERCOM__ '${APPSMITH_DISABLE_INTERCOM}';
sub_filter __APPSMITH_DISABLE_BETTERBUGS__ '${APPSMITH_DISABLE_BETTERBUGS}';
sub_filter __APPSMITH_ZIPY_SDK_KEY__ '${APPSMITH_ZIPY_SDK_KEY}';
sub_filter __APPSMITH_HIDE_WATERMARK__ '${APPSMITH_HIDE_WATERMARK}';
sub_filter __APPSMITH_DISABLE_IFRAME_WIDGET_SANDBOX__ '${APPSMITH_DISABLE_IFRAME_WIDGET_SANDBOX}';
set $appsmith_sentry_dsn '${APPSMITH_SENTRY_DSN}';
set $appsmith_smart_look_id '${APPSMITH_SMART_LOOK_ID}';
set $appsmith_segment_key '${APPSMITH_SEGMENT_KEY}';
set $appsmith_client_log_level '${APPSMITH_CLIENT_LOG_LEVEL}';
set $appsmith_sentry_release '${APPSMITH_SENTRY_RELEASE}';
set $appsmith_sentry_environment '${APPSMITH_SENTRY_ENVIRONMENT}';
set $appsmith_version_id '${APPSMITH_VERSION_ID}';
set $appsmith_version_release_date '${APPSMITH_VERSION_RELEASE_DATE}';
set $appsmith_intercom_app_id '${APPSMITH_INTERCOM_APP_ID}';
set $appsmith_mail_enabled '${APPSMITH_MAIL_ENABLED}';
set $appsmith_recaptcha_site_key '${APPSMITH_RECAPTCHA_SITE_KEY}';
set $appsmith_disable_intercom '${APPSMITH_DISABLE_INTERCOM}';
set $appsmith_disable_betterbugs '${APPSMITH_DISABLE_BETTERBUGS}';
set $appsmith_zipy_sdk_key '${APPSMITH_ZIPY_SDK_KEY}';
set $appsmith_hide_watermark '${APPSMITH_HIDE_WATERMARK}';
set $appsmith_disable_iframe_widget_sandbox '${APPSMITH_DISABLE_IFRAME_WIDGET_SANDBOX}';
set $appsmith_new_relic_otlp_license_key '${APPSMITH_NEW_RELIC_OTLP_LICENSE_KEY}';
set $appsmith_new_relic_otel_exporter_otlp_endpoint '${APPSMITH_NEW_RELIC_OTEL_EXPORTER_OTLP_ENDPOINT}';
set $appsmith_frontend_tracing_url '${APPSMITH_FRONTEND_TRACING_URL}';
Comment on lines +46 to +48
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot Mar 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🌐 Web query:

Is a New Relic OTLP license key safe to expose in browser-delivered frontend code? Please cite official New Relic documentation and the recommended key type for browser telemetry ingestion.

💡 Result:

No, a New Relic OTLP license key (account license key or ingest key) is not safe to expose in browser-delivered frontend code. OTLP ingest uses the account license key as the api-key header, which allows sending arbitrary telemetry data to your New Relic account. Exposing it client-side risks abuse, as evidenced by security concerns raised when such keys are exposed in source code. New Relic documentation explicitly distinguishes: license keys are for most data ingest (except browser/mobile), while browser telemetry uses a separate, safer browser key (browser_monitoring_key), which is designed for client-side exposure in the browser agent JavaScript snippet. There is no official support or recommendation for using OTLP directly from browsers; browser monitoring uses proprietary endpoints and the browser key, not OTLP/license key.

Citations:

Replace OTLP license key with New Relic browser-specific key for frontend exposure.

Lines 46 and 66 expose APPSMITH_NEW_RELIC_OTLP_LICENSE_KEY to the browser. OTLP license keys are account credentials that allow arbitrary telemetry ingestion and must never be exposed client-side. Use the browser-specific browser_monitoring_key instead, designed for safe client-side exposure and recommended by New Relic for browser telemetry.

Also applies to: 66-68

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@app/client/docker/templates/nginx-app.conf.template` around lines 46 - 48,
The template currently exposes the OTLP license key via the variable set
$appsmith_new_relic_otlp_license_key (APPSMITH_NEW_RELIC_OTLP_LICENSE_KEY),
which must not be sent to the browser; replace uses of
APPSMITH_NEW_RELIC_OTLP_LICENSE_KEY with the New Relic browser monitoring key
environment variable (e.g. APPSMITH_NEW_RELIC_BROWSER_MONITORING_KEY) and update
the template variable name accordingly (e.g. set
$appsmith_new_relic_browser_key) wherever $appsmith_new_relic_otlp_license_key
appears (lines near the current set $appsmith_new_relic_otlp_license_key and the
similar block at lines ~66-68), ensuring the OTLP key is never exposed
client-side.


sub_filter __APPSMITH_NEW_RELIC_OTLP_LICENSE_KEY__ '${APPSMITH_NEW_RELIC_OTLP_LICENSE_KEY}';
sub_filter __APPSMITH_NEW_RELIC_OTEL_EXPORTER_OTLP_ENDPOINT__ '${APPSMITH_NEW_RELIC_OTEL_EXPORTER_OTLP_ENDPOINT}';
sub_filter __APPSMITH_FRONTEND_TRACING_URL__ '${APPSMITH_FRONTEND_TRACING_URL}';
sub_filter __APPSMITH_SENTRY_DSN__ $appsmith_sentry_dsn;
sub_filter __APPSMITH_SMART_LOOK_ID__ $appsmith_smart_look_id;
sub_filter __APPSMITH_SEGMENT_KEY__ $appsmith_segment_key;
sub_filter __APPSMITH_CLIENT_LOG_LEVEL__ $appsmith_client_log_level;
sub_filter __APPSMITH_SENTRY_RELEASE__ $appsmith_sentry_release;
sub_filter __APPSMITH_SENTRY_ENVIRONMENT__ $appsmith_sentry_environment;
sub_filter __APPSMITH_VERSION_ID__ $appsmith_version_id;
sub_filter __APPSMITH_VERSION_RELEASE_DATE__ $appsmith_version_release_date;
sub_filter __APPSMITH_INTERCOM_APP_ID__ $appsmith_intercom_app_id;
sub_filter __APPSMITH_MAIL_ENABLED__ $appsmith_mail_enabled;
sub_filter __APPSMITH_RECAPTCHA_SITE_KEY__ $appsmith_recaptcha_site_key;
sub_filter __APPSMITH_DISABLE_INTERCOM__ $appsmith_disable_intercom;
sub_filter __APPSMITH_DISABLE_BETTERBUGS__ $appsmith_disable_betterbugs;
sub_filter __APPSMITH_ZIPY_SDK_KEY__ $appsmith_zipy_sdk_key;
sub_filter __APPSMITH_HIDE_WATERMARK__ $appsmith_hide_watermark;
sub_filter __APPSMITH_DISABLE_IFRAME_WIDGET_SANDBOX__ $appsmith_disable_iframe_widget_sandbox;
sub_filter __APPSMITH_NEW_RELIC_OTLP_LICENSE_KEY__ $appsmith_new_relic_otlp_license_key;
sub_filter __APPSMITH_NEW_RELIC_OTEL_EXPORTER_OTLP_ENDPOINT__ $appsmith_new_relic_otel_exporter_otlp_endpoint;
sub_filter __APPSMITH_FRONTEND_TRACING_URL__ $appsmith_frontend_tracing_url;
}


Expand Down