opencode/picoclaw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(security): add nil checks for envSet and extraEnv

Browse source
This commit is contained in:
Keith Patrick 2026-03-08 22:56:07 +00:00
parent 7cc6ed435b
commit ceac1e7671
1 changed files with 10 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
pkg/tools/shell/env.go
View file

@ -115,17 +115,21 @@ func BuildSanitizedEnv(baseEnv []string, extraAllowlist []string, envSet, extraE
}
}
for k, v := range envSet {
vars[envKey(k)] = v
if envSet != nil {
for k, v := range envSet {
vars[envKey(k)] = v
}
}
// Merge extraEnv (tool call) - highest priority
// Filter against LLM blocklist to prevent override of sensitive vars
for k, v := range extraEnv {
if LLMBlocklist[envKey(k)] {
continue // Skip blocked vars
if extraEnv != nil {
for k, v := range extraEnv {
if LLMBlocklist[envKey(k)] {
continue // Skip blocked vars
}
vars[envKey(k)] = v
}
vars[envKey(k)] = v
}
// Convert to []string for exec.Cmd.Env