opencode/picoclaw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(security): add config env_allowlist support

Browse source
This commit is contained in:
Keith Patrick 2026-03-08 23:04:15 +00:00
parent ceac1e7671
commit bf7279e2a1
2 changed files with 8 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
pkg/config/config.go
View file

@ -645,7 +645,8 @@ type ExecConfig struct {
CustomDenyPatterns []string ` env:"PICOCLAW_TOOLS_EXEC_CUSTOM_DENY_PATTERNS" json:"custom_deny_patterns"` CustomDenyPatterns []string ` env:"PICOCLAW_TOOLS_EXEC_CUSTOM_DENY_PATTERNS" json:"custom_deny_patterns"`
CustomAllowPatterns []string ` env:"PICOCLAW_TOOLS_EXEC_CUSTOM_ALLOW_PATTERNS" json:"custom_allow_patterns"` CustomAllowPatterns []string ` env:"PICOCLAW_TOOLS_EXEC_CUSTOM_ALLOW_PATTERNS" json:"custom_allow_patterns"`
TimeoutSeconds int ` env:"PICOCLAW_TOOLS_EXEC_TIMEOUT_SECONDS" json:"timeout_seconds"` // 0 means use default (60s) TimeoutSeconds int ` env:"PICOCLAW_TOOLS_EXEC_TIMEOUT_SECONDS" json:"timeout_seconds"` // 0 means use default (60s)
EnvSet map[string]string ` json:"env_set"` // env vars to set for all exec commands EnvSet map[string]string ` json:"env_set"` // env vars to set for all exec commands
EnvAllowlist []string ` json:"env_allowlist"` // additional env vars to allow (extends default)
} }
type SkillsToolsConfig struct { type SkillsToolsConfig struct {

8
pkg/tools/shell.go
View file

@ -138,11 +138,15 @@ func NewExecToolWithConfig(workingDir string, restrict bool, config *config.Conf
timeout = time.Duration(config.Tools.Exec.TimeoutSeconds) * time.Second timeout = time.Duration(config.Tools.Exec.TimeoutSeconds) * time.Second
} }
// Get envSet from config (if provided) // Get envSet and envAllowlist from config (if provided)
var envSet map[string]string var envSet map[string]string
var envAllowlist []string
if config != nil && config.Tools.Exec.EnvSet != nil { if config != nil && config.Tools.Exec.EnvSet != nil {
envSet = config.Tools.Exec.EnvSet envSet = config.Tools.Exec.EnvSet
} }
if config != nil && config.Tools.Exec.EnvAllowlist != nil {
envAllowlist = config.Tools.Exec.EnvAllowlist
}
return &ExecTool{ return &ExecTool{
workingDir: workingDir, workingDir: workingDir,
@ -151,7 +155,7 @@ func NewExecToolWithConfig(workingDir string, restrict bool, config *config.Conf
allowPatterns: nil, allowPatterns: nil,
customAllowPatterns: customAllowPatterns, customAllowPatterns: customAllowPatterns,
restrictToWorkspace: restrict, restrictToWorkspace: restrict,
cachedEnv: shell.BuildSanitizedEnv(os.Environ(), nil, envSet, nil), cachedEnv: shell.BuildSanitizedEnv(os.Environ(), envAllowlist, envSet, nil),
}, nil }, nil
} }