opencode/picoclaw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(security): add nil checks for envSet and extraEnv

Browse source
This commit is contained in:
Keith Patrick 2026-03-08 22:56:07 +00:00
parent 7cc6ed435b
commit ceac1e7671
1 changed files with 10 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
pkg/tools/shell/env.go
View file

@ -115,18 +115,22 @@ func BuildSanitizedEnv(baseEnv []string, extraAllowlist []string, envSet, extraE
} }
} }
if envSet != nil {
for k, v := range envSet { for k, v := range envSet {
vars[envKey(k)] = v vars[envKey(k)] = v
} }
}
// Merge extraEnv (tool call) - highest priority // Merge extraEnv (tool call) - highest priority
// Filter against LLM blocklist to prevent override of sensitive vars // Filter against LLM blocklist to prevent override of sensitive vars
if extraEnv != nil {
for k, v := range extraEnv { for k, v := range extraEnv {
if LLMBlocklist[envKey(k)] { if LLMBlocklist[envKey(k)] {
continue // Skip blocked vars continue // Skip blocked vars
} }
vars[envKey(k)] = v vars[envKey(k)] = v
} }
}
// Convert to []string for exec.Cmd.Env // Convert to []string for exec.Cmd.Env
result := make([]string, 0, len(vars)) result := make([]string, 0, len(vars))