CVE-2023-3431: Improper Access Control (CWE-284)
value: Improper Access Control in GitHub repository plantuml/plantuml prior to 1.2023.9.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 5.3
Published: 2023-06-27T15:15Z
Repository: https://github.com/plantuml/plantuml
Language: Java
Files changed: gradle.properties, src/net/sourceforge/plantuml/OptionFlags.java, src/net/sourceforge/plantuml/preproc/ImportedFiles.java, src/net/sourceforge/plantuml/security/SFile.java, src/net/sourceforge/plantuml/security/SURL.java, src/net/sourceforge/plantuml/security/SecurityProfile.java, src/net/sourceforge/plantuml/security/SecurityUtils.java, src/net/sourceforge/plantuml/tim/stdlib/FileExists.java, src/net/sourceforge/plantuml/tim/stdlib/Getenv.java, src/net/sourceforge/plantuml/tim/stdlib/LoadJson.java, src/net/sourceforge/plantuml/version/LicenseInfo.java, src/net/sourceforge/plantuml/version/PSystemVersion.java, src/net/sourceforge/plantuml/version/Version.java
Commit date: 2023-06-13 12:41:34 +0200
Commit message: feat: remove legacy ALLOW_INCLUDE use PLANTUML_SECURITY_PROFILE instead
https://github.com/plantuml/plantuml-server/issues/232

Diff: diff --git a/gradle.properties b/gradle.properties
index fe3b6bc48..4c1645003 100644
--- a/gradle.properties
+++ b/gradle.properties
@@ -1,4 +1,4 @@
 # Warning, "version" should be the same in gradle.properties and Version.java
 # Any idea anyone how to magically synchronize those :-) ?
-version = 1.2023.9beta4
+version = 1.2023.9beta5
 org.gradle.workers.max = 3
\ No newline at end of file
diff --git a/src/net/sourceforge/plantuml/OptionFlags.java b/src/net/sourceforge/plantuml/OptionFlags.java
index 90933416a..6c2bf5bac 100644
--- a/src/net/sourceforge/plantuml/OptionFlags.java
+++ b/src/net/sourceforge/plantuml/OptionFlags.java
@@ -72,15 +72,15 @@ public class OptionFlags {
 	// ::comment when __CORE__
 	// static public final boolean PBBACK = false;
 	// static public boolean GRAPHVIZCACHE = false;
 	// static public final boolean TRACE_DOT = false;
 
-	static public boolean ALLOW_INCLUDE = true;
-
-	static public void setAllowIncludeFalse() {
-		ALLOW_INCLUDE = false;
-	}
+//	static public boolean ALLOW_INCLUDE = true;
+//
+//	static public void setAllowIncludeFalse() {
+//		ALLOW_INCLUDE = false;
+//	}
 
 	static public void setMaxPixel(int max) {
 	}
 
 	static public final boolean USE_HECTOR = false;
diff --git a/src/net/sourceforge/plantuml/preproc/ImportedFiles.java b/src/net/sourceforge/plantuml/preproc/ImportedFiles.java
index 42c91bf99..84667c097 100644
--- a/src/net/sourceforge/plantuml/preproc/ImportedFiles.java
+++ b/src/net/sourceforge/plantuml/preproc/ImportedFiles.java
@@ -38,11 +38,10 @@ package net.sourceforge.plantuml.preproc;
 
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.List;
 
-import net.sourceforge.plantuml.OptionFlags;
 import net.sourceforge.plantuml.file.AFile;
 import net.sourceforge.plantuml.file.AFileRegular;
 import net.sourceforge.plantuml.file.AFileZipEntry;
 import net.sourceforge.plantuml.file.AParentFolder;
 import net.sourceforge.plantuml.security.SFile;
@@ -61,13 +60,13 @@ public class ImportedFiles {
 		this.imported = imported;
 		this.currentDir = currentDir;
 	}
 
 	public ImportedFiles withCurrentDir(AParentFolder newCurrentDir) {
-		if (newCurrentDir == null) {
+		if (newCurrentDir == null) 
 			return this;
-		}
+		
 		return new ImportedFiles(imported, newCurrentDir);
 	}
 
 	public static ImportedFiles createImportedFiles(AParentFolder newCurrentDir) {
 		return new ImportedFiles(new ArrayList<SFile>(), newCurrentDir);
@@ -80,31 +79,31 @@ public class ImportedFiles {
 
 	public AFile getAFile(String nameOrPath) throws IOException {
 		// Log.info("ImportedFiles::getAFile nameOrPath = " + nameOrPath);
 		// Log.info("ImportedFiles::getAFile currentDir = " + currentDir);
 		final AParentFolder dir = currentDir;
-		if (dir == null || isAbsolute(nameOrPath)) {
+		if (dir == null || isAbsolute(nameOrPath)) 
 			return new AFileRegular(new SFile(nameOrPath).getCanonicalFile());
-		}
+		
 		// final File filecurrent = SecurityUtils.File(dir.getAbsoluteFile(),
 		// nameOrPath);
 		final AFile filecurrent = dir.getAFile(nameOrPath);
 		Log.info("ImportedFiles::getAFile filecurrent = " + filecurrent);
-		if (filecurrent != null && filecurrent.isOk()) {
+		if (filecurrent != null && filecurrent.isOk()) 
 			return filecurrent;
-		}
+		
 		for (SFile d : getPath()) {
 			if (d.isDirectory()) {
 				final SFile file = d.file(nameOrPath);
-				if (file.exists()) {
+				if (file.exists()) 
 					return new AFileRegular(file.getCanonicalFile());
-				}
+				
 			} else if (d.isFile()) {
 				final AFileZipEntry zipEntry = new AFileZipEntry(d, nameOrPath);
-				if (zipEntry.isOk()) {
+				if (zipEntry.isOk()) 
 					return zipEntry;
-				}
+				
 			}
 		}
 		return filecurrent;
 	}
 
@@ -148,29 +147,27 @@ public class ImportedFiles {
 			entry = null;
 		} else {
 			file = getAFile(filename.substring(0, idx));
 			entry = filename.substring(idx + 1);
 		}
-		if (isAllowed(file) == false)
+		// if (isAllowed(file) == false)
+		if (file == null || file.getUnderlyingFile().isFileOk() == false)
 			return FileWithSuffix.none();
 
 		return new FileWithSuffix(filename, suffix, file, entry);
 	}
 
-	private boolean isAllowed(AFile file) throws IOException {
-		// ::comment when __CORE__
-		if (OptionFlags.ALLOW_INCLUDE)
-			return true;
-
-		if (file != null) {
-			final SFile folder = file.getSystemFolder();
-			// System.err.println("canonicalPath=" + path + " " + folder + " " +
-			// INCLUDE_PATH);
-			if (includePath().contains(folder))
-				return true;
-
-		}
-		// ::done
-		return false;
-	}
+//	private boolean isAllowed(AFile file) throws IOException {
+//		// ::comment when __CORE__
+//		if (file != null) {
+//			final SFile folder = file.getSystemFolder();
+//			// System.err.println("canonicalPath=" + path + " " + folder + " " +
+//			// INCLUDE_PATH);
+//			if (includePath().contains(folder) && folder.isFileOk())
+//				return true;
+//
+//		}
+//		// ::done
+//		return false;
+//	}
 
 }
diff --git a/src/net/sourceforge/plantuml/security/SFile.java b/src/net/sourceforge/plantuml/security/SFile.java
index bfcaef0dd..7fd034ab7 100644
--- a/src/net/sourceforge/plantuml/security/SFile.java
+++ b/src/net/sourceforge/plantuml/security/SFile.java
@@ -115,13 +115,13 @@ public class SFile implements Comparable<SFile> {
 	private SFile(File internal) {
 		this.internal = internal;
 	}
 
 	public static SFile fromFile(File internal) {
-		if (internal == null) {
+		if (internal == null)
 			return null;
-		}
+
 		return new SFile(internal);
 	}
 
 	public SFile file(String name) {
 		return new SFile(this, name);
@@ -255,11 +255,11 @@ public class SFile implements Comparable<SFile> {
 	}
 
 	/**
 	 * Check SecurityProfile to see if this file can be open.
 	 */
-	private boolean isFileOk() {
+	public boolean isFileOk() {
 		// ::comment when __CORE__
 		if (SecurityUtils.getSecurityProfile() == SecurityProfile.SANDBOX)
 			// In SANDBOX, we cannot read any files
 			return false;
 
diff --git a/src/net/sourceforge/plantuml/security/SURL.java b/src/net/sourceforge/plantuml/security/SURL.java
index 019915851..578a4a9c9 100644
--- a/src/net/sourceforge/plantuml/security/SURL.java
+++ b/src/net/sourceforge/plantuml/security/SURL.java
@@ -214,11 +214,11 @@ public class SURL {
 	}
 
 	/**
 	 * Check SecurityProfile to see if this URL can be opened.
 	 */
-	private boolean isUrlOk() {
+	public boolean isUrlOk() {
 		// ::comment when __CORE__
 		if (SecurityUtils.getSecurityProfile() == SecurityProfile.SANDBOX)
 			// In SANDBOX, we cannot read any URL
 			return false;
 
diff --git a/src/net/sourceforge/plantuml/security/SecurityProfile.java b/src/net/sourceforge/plantuml/security/SecurityProfile.java
index fb67d07a9..08bd48850 100644
--- a/src/net/sourceforge/plantuml/security/SecurityProfile.java
+++ b/src/net/sourceforge/plantuml/security/SecurityProfile.java
@@ -53,11 +53,11 @@ package net.sourceforge.plantuml.security;
  * There is also a default value, which is LEGACY in this current
  * implementation.
  * 
  */
 public enum SecurityProfile {
-    // ::remove folder when __HAXE__
+	// ::remove folder when __HAXE__
 
 	/**
 	 * Running in SANDBOX mode is completely secure. No local file can be read
 	 * (except dot executable) No remote URL access can be used No technical
 	 * information are print to users.
@@ -159,6 +159,19 @@ public enum SecurityProfile {
 			return 1000L * 60 * 5;
 		}
 		throw new AssertionError();
 	}
 
+	public boolean canWeReadThisEnvironmentVariable(String name) {
+		if (name == null)
+			return false;
+
+		if (this == UNSECURE)
+			return true;
+		
+		if (name.toLowerCase().startsWith("plantuml"))
+			return true;
+		
+		return true;
+	}
+
 }
diff --git a/src/net/sourceforge/plantuml/security/SecurityUtils.java b/src/net/sourceforge/plantuml/security/SecurityUtils.java
index 655ed2353..5fc01b6e1 100644
--- a/src/net/sourceforge/plantuml/security/SecurityUtils.java
+++ b/src/net/sourceforge/plantuml/security/SecurityUtils.java
@@ -220,20 +220,20 @@ public class SecurityUtils {
 
 		final String alternateName = name.replace(".", "_").toUpperCase();
 		return System.getenv(alternateName);
 	}
 
-	/**
-	 * Checks the environment variable and returns true if the variable is used in
-	 * security context. In this case, the value should not be displayed in scripts.
-	 *
-	 * @param name Environment variable to check
-	 * @return true, if this is a secret variable
-	 */
-	public static boolean isSecurityEnv(String name) {
-		return name != null && name.toLowerCase().startsWith("plantuml.security.");
-	}
+//	/**
+//	 * Checks the environment variable and returns true if the variable is used in
+//	 * security context. In this case, the value should not be displayed in scripts.
+//	 *
+//	 * @param name Environment variable to check
+//	 * @return true, if this is a secret variable
+//	 */
+//	public static boolean isSecurityEnv(String name) {
+//		return name != null && name.toLowerCase().startsWith("plantuml.security.");
+//	}
 
 	/**
 	 * Configuration for Non-SSL authentication methods.
 	 *
 	 * @return true, if plantUML should allow authentication in plain connections
diff --git a/src/net/sourceforge/plantuml/tim/stdlib/FileExists.java b/src/net/sourceforge/plantuml/tim/stdlib/FileExists.java
index ddc976b09..47355c4dd 100644
--- a/src/net/sourceforge/plantuml/tim/stdlib/FileExists.java
+++ b/src/net/sourceforge/plantuml/tim/stdlib/FileExists.java
@@ -36,11 +36,10 @@ package net.sourceforge.plantuml.tim.stdlib;
 
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
 
-import net.sourceforge.plantuml.OptionFlags;
 import net.sourceforge.plantuml.security.SFile;
 import net.sourceforge.plantuml.tim.EaterException;
 import net.sourceforge.plantuml.tim.EaterExceptionLocated;
 import net.sourceforge.plantuml.tim.TContext;
 import net.sourceforge.plantuml.tim.TFunctionSignature;
@@ -59,20 +58,15 @@ public class FileExists extends SimpleReturnFunction {
 	}
 
 	public TValue executeReturnFunction(TContext context, TMemory memory, LineLocation location, List<TValue> values,
 			Map<String, TValue> named) throws EaterException, EaterExceptionLocated {
 		// ::comment when __CORE__
-		if (OptionFlags.ALLOW_INCLUDE == false)
-			// ::done
-			return TValue.fromBoolean(false);
-		// ::comment when __CORE__
-
 		final String path = values.get(0).toString();
-		return TValue.fromBoolean(fileExists(path));
+		return TValue.fromBoolean(new SFile(path).exists());
 		// ::done
-	}
 
-	private boolean fileExists(String path) {
-		final SFile f = new SFile(path);
-		return f.exists();
+		// ::uncomment when __CORE__
+		// return TValue.fromBoolean(false);
+		// ::done
 	}
+
 }
diff --git a/src/net/sourceforge/plantuml/tim/stdlib/Getenv.java b/src/net/sourceforge/plantuml/tim/stdlib/Getenv.java
index 0e4431188..6e947d050 100644
--- a/src/net/sourceforge/plantuml/tim/stdlib/Getenv.java
+++ b/src/net/sourceforge/plantuml/tim/stdlib/Getenv.java
@@ -36,11 +36,10 @@ package net.sourceforge.plantuml.tim.stdlib;
 
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
 
-import net.sourceforge.plantuml.OptionFlags;
 import net.sourceforge.plantuml.security.SecurityUtils;
 import net.sourceforge.plantuml.tim.EaterException;
 import net.sourceforge.plantuml.tim.EaterExceptionLocated;
 import net.sourceforge.plantuml.tim.TContext;
 import net.sourceforge.plantuml.tim.TFunctionSignature;
@@ -59,32 +58,31 @@ public class Getenv extends SimpleReturnFunction {
 	}
 
 	public TValue executeReturnFunction(TContext context, TMemory memory, LineLocation location, List<TValue> values,
 			Map<String, TValue> named) throws EaterException, EaterExceptionLocated {
 		// ::comment when __CORE__
-		if (OptionFlags.ALLOW_INCLUDE == false)
-			// ::done
-			return TValue.fromString("");
-		// ::comment when __CORE__
-
-		final String name = values.get(0).toString();
-		final String value = getenv(name);
+		final String value = getenv(values.get(0).toString());
 		if (value == null)
 			return TValue.fromString("");
 
 		return TValue.fromString(value);
 		// ::done
+
+		// ::uncomment when __CORE__
+		// return TValue.fromString("");
+		// ::done
 	}
 
 	// ::comment when __CORE__
 	private String getenv(String name) {
 		// Check, if the script requests secret information.
 		// A plantuml server should have an own SecurityManager to
 		// avoid access to properties and environment variables, but we should
 		// also stop here in other deployments.
-		if (SecurityUtils.isSecurityEnv(name))
+		if (SecurityUtils.getSecurityProfile().canWeReadThisEnvironmentVariable(name) == false)
 			return null;
+		
 		final String env = System.getProperty(name);
 		if (env != null)
 			return env;
 
 		return System.getenv(name);
diff --git a/src/net/sourceforge/plantuml/tim/stdlib/LoadJson.java b/src/net/sourceforge/plantuml/tim/stdlib/LoadJson.java
index 29b2436d7..19dffd462 100755
--- a/src/net/sourceforge/plantuml/tim/stdlib/LoadJson.java
+++ b/src/net/sourceforge/plantuml/tim/stdlib/LoadJson.java
@@ -163,13 +163,12 @@ public class LoadJson extends SimpleReturnFunction {
 	private String loadStringData(String path, String charset) throws EaterException, UnsupportedEncodingException {
 
 		byte[] byteData = null;
 		if (path.startsWith("http://") || path.startsWith("https://")) {
 			final SURL url = SURL.create(path);
-			if (url == null)
-				throw EaterException.located("load JSON: Invalid URL " + path);
-			byteData = url.getBytes();
+			if (url != null)
+				byteData = url.getBytes();
 			// ::comment when __CORE__
 		} else {
 			try {
 				final SFile file = FileSystem.getInstance().getFile(path);
 				if (file != null && file.exists() && file.canRead() && !file.isDirectory()) {
@@ -177,11 +176,10 @@ public class LoadJson extends SimpleReturnFunction {
 					FileUtils.copyToStream(file, out);
 					byteData = out.toByteArray();
 				}
 			} catch (IOException e) {
 				Logme.error(e);
-				throw EaterException.located("load JSON: Cannot read file " + path + ". " + e.getMessage());
 			}
 			// ::done
 		}
 
 		if (byteData == null || byteData.length == 0)
diff --git a/src/net/sourceforge/plantuml/version/LicenseInfo.java b/src/net/sourceforge/plantuml/version/LicenseInfo.java
index bc8af9922..c402cb2d1 100644
--- a/src/net/sourceforge/plantuml/version/LicenseInfo.java
+++ b/src/net/sourceforge/plantuml/version/LicenseInfo.java
@@ -106,12 +106,12 @@ public class LicenseInfo {
 		return retrieveQuick().isValid();
 	}
 
 	public static synchronized LicenseInfo retrieveNamedSlow() {
 		cache = LicenseInfo.NONE;
-		if (OptionFlags.ALLOW_INCLUDE == false)
-			return cache;
+//		if (OptionFlags.ALLOW_INCLUDE == false)
+//			return cache;
 
 		final String key = prefs.get("license", "");
 		if (key.length() > 0) {
 			cache = setIfValid(retrieveNamed(key), cache);
 			if (cache.isValid())
diff --git a/src/net/sourceforge/plantuml/version/PSystemVersion.java b/src/net/sourceforge/plantuml/version/PSystemVersion.java
index 22da1ea6b..2a112aaa3 100644
--- a/src/net/sourceforge/plantuml/version/PSystemVersion.java
+++ b/src/net/sourceforge/plantuml/version/PSystemVersion.java
@@ -173,13 +173,12 @@ public class PSystemVersion extends PlainStringsDiagram {
 //		strings.add("Compiled with CheerpJ 2.3");
 //		strings.add("Powered by CheerpJ, a Leaning Technologies Java tool");
 		// :: done
 		// :: comment when __CORE__
 		GraphvizCrash.checkOldVersionWarning(strings);
-		if (OptionFlags.ALLOW_INCLUDE) {
-			if (SecurityUtils.getSecurityProfile() == SecurityProfile.UNSECURE)
-				strings.add("Loaded from " + Version.getJarPath());
+		if (SecurityUtils.getSecurityProfile() == SecurityProfile.UNSECURE) {
+			strings.add("Loaded from " + Version.getJarPath());
 
 			if (OptionFlags.getInstance().isWord()) {
 				strings.add("Word Mode");
 				strings.add("Command Line: " + Run.getCommandLine());
 				strings.add("Current Dir: " + new SFile(".").getAbsolutePath());
diff --git a/src/net/sourceforge/plantuml/version/Version.java b/src/net/sourceforge/plantuml/version/Version.java
index bb24e3520..b2ac72be9 100644
--- a/src/net/sourceforge/plantuml/version/Version.java
+++ b/src/net/sourceforge/plantuml/version/Version.java
@@ -44,11 +44,11 @@ import net.sourceforge.plantuml.utils.SignatureUtils;
 public class Version {
 	// ::remove folder when __HAXE__
 
 	// Warning, "version" should be the same in gradle.properties and Version.java
 	// Any idea anyone how to magically synchronize those :-) ?
-	private static final String version = "1.2023.9beta4";
+	private static final String version = "1.2023.9beta5";
 
 	public static String versionString() {
 		return version;
 	}
 

Vulnerable code: version = 1.2023.9beta4
	static public boolean ALLOW_INCLUDE = true;

	static public void setAllowIncludeFalse() {
		ALLOW_INCLUDE = false;
	}
import net.sourceforge.plantuml.OptionFlags;
		if (newCurrentDir == null) {
		}
		if (dir == null || isAbsolute(nameOrPath)) {
		}
		if (filecurrent != null && filecurrent.isOk()) {
		}
				if (file.exists()) {
				}
				if (zipEntry.isOk()) {
				}
		if (isAllowed(file) == false)
	private boolean isAllowed(AFile file) throws IOException {
		// ::comment when __CORE__
		if (OptionFlags.ALLOW_INCLUDE)
			return true;

		if (file != null) {
			final SFile folder = file.getSystemFolder();
			// System.err.println("canonicalPath=" + path + " " + folder + " " +
			// INCLUDE_PATH);
			if (includePath().contains(folder))
				return true;

		}
		// ::done
		return false;
	}
		if (internal == null) {
		}
	private boolean isFileOk() {
	private boolean isUrlOk() {
    // ::remove folder when __HAXE__
	/**
	 * Checks the environment variable and returns true if the variable is used in
	 * security context. In this case, the value should not be displayed in scripts.
	 *
	 * @param name Environment variable to check
	 * @return true, if this is a secret variable
	 */
	public static boolean isSecurityEnv(String name) {
		return name != null && name.toLowerCase().startsWith("plantuml.security.");
	}
import net.sourceforge.plantuml.OptionFlags;
		if (OptionFlags.ALLOW_INCLUDE == false)
			// ::done
			return TValue.fromBoolean(false);
		// ::comment when __CORE__

		return TValue.fromBoolean(fileExists(path));
	}
	private boolean fileExists(String path) {
		final SFile f = new SFile(path);
		return f.exists();
import net.sourceforge.plantuml.OptionFlags;
		if (OptionFlags.ALLOW_INCLUDE == false)
			// ::done
			return TValue.fromString("");
		// ::comment when __CORE__

		final String name = values.get(0).toString();
		final String value = getenv(name);
		if (SecurityUtils.isSecurityEnv(name))
			if (url == null)
				throw EaterException.located("load JSON: Invalid URL " + path);
			byteData = url.getBytes();
				throw EaterException.located("load JSON: Cannot read file " + path + ". " + e.getMessage());
		if (OptionFlags.ALLOW_INCLUDE == false)
			return cache;
		if (OptionFlags.ALLOW_INCLUDE) {
			if (SecurityUtils.getSecurityProfile() == SecurityProfile.UNSECURE)
				strings.add("Loaded from " + Version.getJarPath());
	private static final String version = "1.2023.9beta4";
Fixed code: version = 1.2023.9beta5
//	static public boolean ALLOW_INCLUDE = true;
//
//	static public void setAllowIncludeFalse() {
//		ALLOW_INCLUDE = false;
//	}
		if (newCurrentDir == null) 
		
		if (dir == null || isAbsolute(nameOrPath)) 
		
		if (filecurrent != null && filecurrent.isOk()) 
		
				if (file.exists()) 
				
				if (zipEntry.isOk()) 
				
		// if (isAllowed(file) == false)
		if (file == null || file.getUnderlyingFile().isFileOk() == false)
//	private boolean isAllowed(AFile file) throws IOException {
//		// ::comment when __CORE__
//		if (file != null) {
//			final SFile folder = file.getSystemFolder();
//			// System.err.println("canonicalPath=" + path + " " + folder + " " +
//			// INCLUDE_PATH);
//			if (includePath().contains(folder) && folder.isFileOk())
//				return true;
//
//		}
//		// ::done
//		return false;
//	}
		if (internal == null)

	public boolean isFileOk() {
	public boolean isUrlOk() {
	// ::remove folder when __HAXE__
	public boolean canWeReadThisEnvironmentVariable(String name) {
		if (name == null)
			return false;

		if (this == UNSECURE)
			return true;
		
		if (name.toLowerCase().startsWith("plantuml"))
			return true;
		
		return true;
	}

//	/**
//	 * Checks the environment variable and returns true if the variable is used in
//	 * security context. In this case, the value should not be displayed in scripts.
//	 *
//	 * @param name Environment variable to check
//	 * @return true, if this is a secret variable
//	 */
//	public static boolean isSecurityEnv(String name) {
//		return name != null && name.toLowerCase().startsWith("plantuml.security.");
//	}
		return TValue.fromBoolean(new SFile(path).exists());
		// ::uncomment when __CORE__
		// return TValue.fromBoolean(false);
		// ::done

		final String value = getenv(values.get(0).toString());

		// ::uncomment when __CORE__
		// return TValue.fromString("");
		// ::done
		if (SecurityUtils.getSecurityProfile().canWeReadThisEnvironmentVariable(name) == false)
		
			if (url != null)
				byteData = url.getBytes();
//		if (OptionFlags.ALLOW_INCLUDE == false)
//			return cache;
		if (SecurityUtils.getSecurityProfile() == SecurityProfile.UNSECURE) {
			strings.add("Loaded from " + Version.getJarPath());
	private static final String version = "1.2023.9beta5";