From ceac1e767168cec6a18c05e199d5b0c7ee059809 Mon Sep 17 00:00:00 2001 From: Keith Patrick Date: Sun, 8 Mar 2026 22:56:07 +0000 Subject: [PATCH] fix(security): add nil checks for envSet and extraEnv --- pkg/tools/shell/env.go | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/pkg/tools/shell/env.go b/pkg/tools/shell/env.go index b259ba645..7602c0549 100644 --- a/pkg/tools/shell/env.go +++ b/pkg/tools/shell/env.go @@ -115,17 +115,21 @@ func BuildSanitizedEnv(baseEnv []string, extraAllowlist []string, envSet, extraE } } - for k, v := range envSet { - vars[envKey(k)] = v + if envSet != nil { + for k, v := range envSet { + vars[envKey(k)] = v + } } // Merge extraEnv (tool call) - highest priority // Filter against LLM blocklist to prevent override of sensitive vars - for k, v := range extraEnv { - if LLMBlocklist[envKey(k)] { - continue // Skip blocked vars + if extraEnv != nil { + for k, v := range extraEnv { + if LLMBlocklist[envKey(k)] { + continue // Skip blocked vars + } + vars[envKey(k)] = v } - vars[envKey(k)] = v } // Convert to []string for exec.Cmd.Env