perf: avoid cloning env during expansion

lib/main.js

@@ -4,9 +4,17 @@ function _resolveEscapeSequences (value) {
   return value.replace(/\\\$/g, '$')
 }
 
-function expandValue (value, processEnv, runningParsed) {
-  const env = { ...runningParsed, ...processEnv } // process.env wins
+const propertyIsEnumerable = Object.prototype.propertyIsEnumerable
+
+function getEnvValue (key, processEnv, runningParsed) {
+  if (propertyIsEnumerable.call(processEnv, key)) {
+    return processEnv[key] // process.env wins
+  }
 
+  return runningParsed[key]
+}
+
+function expandValue (value, processEnv, runningParsed) {
   const regex = /(?<!\\)\${([^{}]+)}|(?<!\\)\$([A-Za-z_][A-Za-z0-9_]*)/g
 
   let result = value
@@ -31,13 +39,14 @@ function expandValue (value, processEnv, runningParsed) {
     let value
 
     const key = r.shift()
+    const envValue = getEnvValue(key, processEnv, runningParsed)
 
     if ([':+', '+'].includes(splitter)) {
-      defaultValue = env[key] ? r.join(splitter) : ''
+      defaultValue = envValue ? r.join(splitter) : ''
       value = null
     } else {
       defaultValue = r.join(splitter)
-      value = env[key]
+      value = envValue
     }
 
     if (value) {

tests/main.js

@@ -378,6 +378,27 @@ t.test('can write to an object rather than process.env if user provides it', ct
   ct.end()
 })
 
+t.test('only expands enumerable processEnv properties', ct => {
+  const processEnv = {}
+  Object.defineProperty(processEnv, 'SECRET', {
+    enumerable: false,
+    writable: true,
+    value: 'secret'
+  })
+
+  const dotenv = {
+    processEnv,
+    parsed: {
+      SECRET_EXPAND: '$SECRET'
+    }
+  }
+  const parsed = dotenvExpand.expand(dotenv).parsed
+
+  ct.equal(parsed.SECRET_EXPAND, '')
+
+  ct.end()
+})
+
 t.test('expands environment variables existing already on the machine even with a default with special characters', ct => {
   const dotenv = require('dotenv').config({ path: 'tests/.env.test', processEnv: {} })
   const parsed = dotenvExpand.expand(dotenv).parsed