opencode/picoclaw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(security): remove PICOCLAW_* from default allowlist

Browse source
This commit is contained in:
Keith Patrick 2026-03-08 23:09:36 +00:00
parent bf7279e2a1
commit 2395428e21
1 changed files with 0 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
pkg/tools/shell/env.go
View file

@ -34,12 +34,6 @@ var DefaultEnvAllowlist = map[string]bool{
"HTTP_PROXY": true,
"HTTPS_PROXY": true,
"NO_PROXY": true,
// PICOCLAW_* vars - inherited from parent process if set
"PICOCLAW_HOME": true,
"PICOCLAW_CONFIG": true,
"PICOCLAW_SERVICE_NAME": true,
"PICOCLAW_EXE": true,
"PICOCLAW_WORKSPACE": true,
}
// defaultEnvAllowPrefixes are env var prefixes that are always allowed.