beardthelion
67902dfa9d
config: extend env-writer denylist to the full subprocess-execution class
...
The denylist in save_env_value is the fail-closed gate between the
dashboard's PUT /api/env surface (and every other env writer) and .env,
which lands in os.environ for every subprocess Hermes spawns. It covered
LD_PRELOAD, PYTHONPATH, PATH, EDITOR and GIT_SSH_COMMAND, but missed most
members of the class it states: env-driven git config injection
(GIT_CONFIG_PARAMETERS, GIT_CONFIG_COUNT, GIT_CONFIG_KEY_n/GIT_CONFIG_VALUE_n,
GIT_CONFIG_GLOBAL/SYSTEM), executed git helpers (GIT_SSH, GIT_ASKPASS,
GIT_EDITOR, GIT_SEQUENCE_EDITOR, GIT_PAGER, GIT_EXTERNAL_DIFF,
GIT_PROXY_COMMAND, GIT_TEMPLATE_DIR, GIT_DIR), credential-prompt helpers
(SSH_ASKPASS, SUDO_ASKPASS), shell init files (BASH_ENV, ENV, ZDOTDIR,
PROMPT_COMMAND, VIMINIT, EXINIT, MANPAGER), and interpreter/toolchain
injection (PERL5OPT/PERL5LIB/PERLLIB, RUBYOPT/RUBYLIB, PYTHONBREAKPOINT,
PYTHONCASEOK, CLASSPATH, JAVA_TOOL_OPTIONS/_JAVA_OPTIONS/JDK_JAVA_OPTIONS,
GOFLAGS, RUSTFLAGS).
GIT_CONFIG_KEY_n/GIT_CONFIG_VALUE_n pairs are unbounded, so a new
_ENV_VAR_NAME_DENY_PREFIXES tuple matches whole families by prefix:
LD_, DYLD_, GIT_CONFIG_. The check runs on the Windows-corrected policy
name, so mixed-case spellings are refused there while POSIX's inert
lowercase names stay writable.
git credential helpers and subprocess env construction already null
GIT_CONFIG_GLOBAL/SYSTEM and strip GIT_ASKPASS from child environments
for the same reason, so this closes the write surface those hygiene
paths assume.
Regression tests cover every denied name, the unbounded pairs, near-miss
names that must stay writable (GIT_COMMITTER_NAME, GIT_AUTHOR_NAME,
GIT_TERMINAL_PROMPT, POSIX-lowercase spellings), and Windows mixed-case
denial.
2026-09-20 00:08:36 -07:00
..
2026-09-18 09:18:00 -07:00
2026-09-15 20:44:42 +05:30
2026-09-16 06:39:15 -05:00
2026-09-17 00:02:09 -07:00
2026-09-18 10:32:48 -07:00
2026-09-15 20:44:42 +05:30
2026-09-16 23:22:49 +05:30
2026-09-15 20:44:42 +05:30
2026-09-15 20:44:42 +05:30
2026-09-16 17:16:06 -07:00
2026-09-19 09:38:01 -07:00
2026-09-16 16:48:42 -07:00
2026-09-19 09:33:05 -07:00
2026-09-19 12:11:59 -07:00
2026-09-19 09:40:56 -07:00
2026-09-19 00:59:44 -07:00
2026-09-19 10:29:37 -07:00
2026-09-18 10:17:59 -07:00
2026-09-17 09:02:26 -07:00
2026-09-16 14:34:59 -07:00
2026-09-16 17:16:06 -07:00
2026-09-19 09:23:22 -07:00
2026-09-19 09:31:28 -07:00
2026-09-17 00:34:50 -05:00
2026-09-19 03:43:58 +05:30
2026-09-16 17:49:48 -07:00
2026-09-16 16:53:40 -07:00
2026-09-15 21:46:41 -07:00
2026-09-15 18:24:22 -07:00
2026-09-15 18:24:22 -07:00
2026-09-15 06:16:38 -07:00
2026-09-19 01:43:15 -07:00
2026-09-18 10:24:15 -07:00
2026-09-16 17:23:44 -07:00
2026-09-15 20:47:06 +05:30
2026-09-18 09:35:49 -07:00
2026-09-19 09:43:20 -07:00
2026-09-19 03:15:10 -07:00
2026-09-19 09:40:23 -07:00
2026-09-18 19:57:08 -07:00
2026-09-18 09:18:00 -07:00
2026-09-18 09:18:00 -07:00
2026-09-19 10:22:33 -07:00
2026-09-18 10:00:29 -07:00
2026-09-19 09:30:56 -07:00
2026-09-19 09:30:56 -07:00
2026-09-16 17:15:38 -07:00
2026-09-15 06:29:50 -07:00
2026-09-15 18:28:49 -07:00
2026-09-19 23:41:10 -07:00
2026-09-15 21:47:48 -07:00
2026-09-18 09:41:02 -07:00
2026-09-18 12:44:32 -07:00
2026-09-20 00:08:36 -07:00
2026-09-19 16:28:57 +05:30
2026-09-16 17:16:06 -07:00
2026-09-18 17:10:12 +02:00
2026-09-18 17:10:12 +02:00
2026-09-18 12:46:54 -07:00
2026-09-18 12:46:54 -07:00
2026-09-19 10:26:08 -07:00
2026-09-16 16:48:42 -07:00
2026-09-19 02:38:49 -07:00
2026-09-16 17:03:16 -07:00
2026-09-18 15:12:27 -07:00
2026-09-18 09:38:01 -07:00
2026-09-17 09:04:11 -07:00
2026-09-18 09:38:01 -07:00
2026-09-16 17:02:02 -07:00
2026-09-16 23:13:20 -04:00
2026-09-16 16:48:42 -07:00
2026-09-19 02:32:35 -07:00
2026-09-17 08:44:06 -07:00
2026-09-16 23:13:20 -04:00
2026-09-17 09:19:19 -07:00
2026-09-18 10:38:08 -07:00
2026-09-16 17:44:36 -07:00
2026-09-19 09:29:18 -07:00
2026-09-18 09:56:28 -07:00
2026-09-16 17:02:34 -07:00
2026-09-18 21:47:13 +05:30
2026-09-16 23:19:45 +05:30
2026-09-20 00:19:04 +05:30
2026-09-19 12:30:32 -07:00
2026-09-17 19:00:40 -04:00
2026-09-19 02:59:51 -07:00
2026-09-16 08:57:18 -07:00
2026-09-18 17:10:12 +02:00
2026-09-16 16:48:42 -07:00
2026-09-18 12:49:13 -07:00
2026-09-18 09:25:59 -07:00
2026-09-19 00:43:49 +05:30
2026-09-19 02:06:55 +05:30
2026-09-16 16:18:17 -05:00
2026-09-19 02:02:14 -07:00
2026-09-19 02:02:14 -07:00
2026-09-18 09:28:39 -07:00
2026-09-18 10:00:29 -07:00
2026-09-19 02:42:26 -07:00
2026-09-15 05:25:39 -07:00
2026-09-18 10:15:11 -07:00
2026-09-19 10:05:26 -07:00
2026-09-18 01:43:35 +05:30
2026-09-15 18:33:43 -07:00
2026-09-19 00:10:41 +05:30
2026-09-18 09:29:44 -07:00
2026-09-15 18:34:40 -07:00
2026-09-15 22:47:03 -07:00
2026-09-18 20:34:16 -07:00
2026-09-18 09:48:41 -07:00
2026-09-18 09:29:44 -07:00
2026-09-18 09:50:19 -07:00
2026-09-18 10:21:42 -07:00
2026-09-18 09:32:02 -07:00
2026-09-17 08:55:01 -07:00
2026-09-18 09:32:02 -07:00
2026-09-18 10:04:23 -07:00
2026-09-15 18:35:09 -07:00
2026-09-18 22:36:24 -07:00
2026-09-16 16:48:42 -07:00
2026-09-17 08:52:53 -07:00
2026-09-16 16:48:42 -07:00
2026-09-15 18:35:32 -07:00
2026-09-18 11:03:57 -07:00
2026-09-18 12:48:16 -07:00
2026-09-16 00:35:00 -07:00
2026-09-15 06:08:20 -07:00
2026-09-16 16:51:45 -07:00
2026-09-18 10:10:05 -07:00
2026-09-16 16:56:22 -07:00
2026-09-19 09:53:48 -07:00
2026-09-15 05:31:16 -07:00
2026-09-15 05:26:25 -07:00
2026-09-16 14:32:54 -04:00
2026-09-18 09:19:04 -07:00
2026-09-17 08:44:33 -07:00
2026-09-19 02:44:02 -07:00
2026-09-19 23:59:11 -07:00
2026-09-16 15:16:09 -05:00
2026-09-16 15:54:47 -05:00
2026-09-18 09:45:32 -07:00
2026-09-19 23:46:42 -07:00
2026-09-15 19:06:54 -07:00
2026-09-18 09:23:13 -07:00
2026-09-16 17:11:01 -07:00
2026-09-15 05:34:29 -07:00
2026-09-18 09:41:02 -07:00
2026-09-19 09:34:40 -07:00
2026-09-18 11:01:52 -07:00
2026-09-17 08:55:04 -07:00
2026-09-19 22:18:25 +05:30
2026-09-19 09:32:32 -07:00
2026-09-16 17:02:56 -07:00
2026-09-18 15:40:37 +05:30
2026-09-19 10:22:01 -07:00
2026-09-19 09:42:49 -07:00
2026-09-18 09:52:03 -07:00
2026-09-15 20:44:42 +05:30
2026-09-15 18:35:59 -07:00
2026-09-19 20:55:20 -07:00
2026-09-19 09:24:25 -07:00
2026-09-18 11:01:52 -07:00
2026-09-16 18:12:34 -07:00
2026-09-19 09:42:18 -07:00
2026-09-19 01:16:39 -07:00
2026-09-16 17:03:25 -07:00
2026-09-18 11:01:52 -07:00
2026-09-17 09:04:11 -07:00
2026-09-18 09:50:52 -07:00
2026-09-16 17:51:11 -07:00
2026-09-18 17:09:28 +02:00
2026-09-16 14:18:39 -07:00
2026-09-15 15:11:33 -07:00
2026-09-17 09:03:29 -07:00
2026-09-19 11:58:06 -07:00
2026-09-18 10:01:01 -07:00
2026-09-19 20:54:06 -07:00
2026-09-19 21:11:30 -07:00
2026-09-17 00:11:27 -07:00
2026-09-19 14:30:36 -07:00
2026-09-18 09:43:19 -07:00
2026-09-15 18:48:59 -07:00
2026-09-19 23:58:35 -07:00
2026-09-18 09:43:19 -07:00
2026-09-18 09:43:19 -07:00
2026-09-16 16:48:42 -07:00
2026-09-16 14:34:22 -07:00
2026-09-16 16:44:53 -07:00
2026-09-15 06:22:15 -07:00
2026-09-16 14:21:14 -07:00
2026-09-16 14:34:22 -07:00
2026-09-19 01:43:14 +05:30
2026-09-18 10:18:40 -07:00
2026-09-19 20:45:06 -07:00
2026-09-18 15:40:37 +05:30
2026-09-17 08:53:48 -07:00
2026-09-18 15:40:37 +05:30
2026-09-15 06:36:19 -07:00
2026-09-18 10:29:13 -07:00
2026-09-18 01:43:35 +05:30
2026-09-19 09:25:29 -07:00
2026-09-19 23:42:20 -07:00
2026-09-15 21:46:37 -07:00
2026-09-17 09:06:59 -07:00
2026-09-18 12:52:36 -07:00
2026-09-18 09:38:01 -07:00
2026-09-18 17:09:28 +02:00
2026-09-19 00:45:43 -07:00
2026-09-17 00:34:50 -05:00
2026-09-19 20:44:24 -07:00
2026-09-15 18:28:03 -07:00
2026-09-19 03:43:03 +05:30
2026-09-18 09:55:21 -07:00
2026-09-19 00:24:50 +05:30
2026-09-16 10:27:34 -07:00
2026-09-16 17:02:13 -07:00
2026-09-18 10:38:41 -07:00
2026-09-16 17:49:48 -07:00
2026-09-16 06:39:15 -05:00
2026-09-15 18:25:46 -07:00
2026-09-18 22:36:41 -07:00
2026-09-19 23:51:25 -07:00
2026-09-20 12:17:52 +05:30
2026-09-18 21:47:13 +05:30
2026-09-18 09:47:06 -07:00
2026-09-18 10:45:07 -07:00
2026-09-17 00:02:09 -07:00
2026-09-19 09:57:21 -07:00
2026-09-15 21:46:41 -07:00
2026-09-18 12:51:22 -07:00
2026-09-18 09:38:01 -07:00
2026-09-18 09:38:34 -07:00
2026-09-18 09:49:46 -07:00
2026-09-19 01:44:53 +05:30
2026-09-18 10:15:11 -07:00
2026-09-16 17:58:25 +00:00
2026-09-15 18:55:47 -07:00
2026-09-18 21:47:13 +05:30
2026-09-19 23:46:08 -07:00
2026-09-19 09:42:18 -07:00
2026-09-15 19:04:00 -07:00
2026-09-19 23:58:35 -07:00
2026-09-15 05:26:25 -07:00
2026-09-16 17:13:56 -07:00
2026-09-17 00:02:09 -07:00
2026-09-17 00:02:09 -07:00
2026-09-19 02:33:41 -07:00
2026-09-16 17:00:50 -07:00
2026-09-15 18:48:35 -07:00
2026-09-19 23:52:01 -07:00
2026-09-16 17:04:46 -07:00
2026-09-18 12:44:04 -07:00
2026-09-20 00:03:06 -07:00
2026-09-17 00:02:09 -07:00
2026-09-19 23:52:01 -07:00
2026-09-17 00:02:09 -07:00
2026-09-18 12:47:23 -07:00
2026-09-19 23:52:01 -07:00
2026-09-17 00:02:09 -07:00
2026-09-18 17:09:28 +02:00
2026-09-19 02:01:36 -07:00
2026-09-19 02:01:36 -07:00
2026-09-18 09:38:01 -07:00
2026-09-19 02:02:14 -07:00
2026-09-17 00:02:09 -07:00
2026-09-19 02:33:41 -07:00
2026-09-19 02:33:41 -07:00
2026-09-19 10:31:14 -07:00
2026-09-19 09:42:49 -07:00
2026-09-19 02:39:51 -07:00
2026-09-18 01:43:35 +05:30
2026-09-16 16:48:42 -07:00
2026-09-16 14:21:14 -07:00
2026-09-16 16:48:42 -07:00
2026-09-18 10:32:15 -07:00
2026-09-16 16:48:42 -07:00
2026-09-18 10:18:40 -07:00
2026-09-19 10:04:52 -07:00
2026-09-16 17:11:08 -07:00
2026-09-16 16:58:22 -07:00
2026-09-18 12:46:54 -07:00
2026-09-18 10:18:40 -07:00
2026-09-15 18:54:51 -07:00
2026-09-19 10:56:19 -07:00
2026-09-16 14:34:22 -07:00
2026-09-16 14:34:22 -07:00
2026-09-17 20:33:31 +05:30
2026-09-19 03:35:57 -07:00
2026-09-19 10:54:40 -07:00
2026-09-18 09:25:59 -07:00
2026-09-16 16:48:42 -07:00
2026-09-15 18:27:06 -07:00
2026-09-16 16:43:08 -07:00
2026-09-15 18:27:06 -07:00
2026-09-16 14:34:59 -07:00