opencode/picoclaw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(security): add nil checks for envSet and extraEnv

Browse source
This commit is contained in:
Keith Patrick 2026-03-08 22:56:07 +00:00
parent 7cc6ed435b
commit ceac1e7671
1 changed files with 10 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
pkg/tools/shell/env.go
View file

@ -115,17 +115,21 @@ func BuildSanitizedEnv(baseEnv []string, extraAllowlist []string, envSet, extraE
} }
} }
for k, v := range envSet { if envSet != nil {
vars[envKey(k)] = v for k, v := range envSet {
vars[envKey(k)] = v
}
} }
// Merge extraEnv (tool call) - highest priority // Merge extraEnv (tool call) - highest priority
// Filter against LLM blocklist to prevent override of sensitive vars // Filter against LLM blocklist to prevent override of sensitive vars
for k, v := range extraEnv { if extraEnv != nil {
if LLMBlocklist[envKey(k)] { for k, v := range extraEnv {
continue // Skip blocked vars if LLMBlocklist[envKey(k)] {
continue // Skip blocked vars
}
vars[envKey(k)] = v
} }
vars[envKey(k)] = v
} }
// Convert to []string for exec.Cmd.Env // Convert to []string for exec.Cmd.Env