fix(dotenv): block workspace runtime env vars#62660
Conversation
Greptile SummaryThis PR tightens the workspace Confidence Score: 5/5Safe to merge — all changes are additive, tighten security, and are covered by regression tests. The denylist expansions are straightforward and correct. All newly blocked keys and prefix families are genuine runtime-control surfaces. The regression tests cover the full set of added entries and verify passthrough still works for user-defined vars. No existing behavior is broken. No P0/P1 findings were identified. No files require special attention.
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
|
@greptile review |
|
@codex review |
|
Codex Review: Didn't find any major issues. Hooray! ℹ️ About Codex in GitHubCodex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback". |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: aaf159afe7
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
* main: (522 commits) fix(browser): re-check interaction-driven navigations (openclaw#63226) test: reuse verbose directive reply imports test: reuse exec directive reply imports fix(browser): harden browser control override loading (openclaw#62663) Matrix: report startup failures as errors auth: persist explicit profile upserts directly test(doctor): mock memory-core runtime seam auth: avoid external cli sync on profile upsert feat: parallelize character eval runs fix: load QA live provider overrides build: stage nostr runtime dependencies fix(dotenv): block workspace runtime env vars (openclaw#62660) build: narrow plugin SDK declaration build test: harden Parallels macOS smoke fallback fix(memory): accept embedded dreaming heartbeat tokens test: harden provider mock isolation docs(config): tighten wording in reference test: reuse followup runner imports test: reuse image generate tool imports Align remote node exec event system messages with untrusted handling (openclaw#62659) ...
* fix(dotenv): block workspace runtime env vars Co-authored-by: zsx <[email protected]> * docs(changelog): add workspace dotenv runtime-control entry * fix(dotenv): block workspace gateway port override --------- Co-authored-by: zsx <[email protected]> Co-authored-by: Devin Robison <[email protected]>
* fix(dotenv): block workspace runtime env vars Co-authored-by: zsx <[email protected]> * docs(changelog): add workspace dotenv runtime-control entry * fix(dotenv): block workspace gateway port override --------- Co-authored-by: zsx <[email protected]> Co-authored-by: Devin Robison <[email protected]>
* fix(dotenv): block workspace runtime env vars Co-authored-by: zsx <[email protected]> * docs(changelog): add workspace dotenv runtime-control entry * fix(dotenv): block workspace gateway port override --------- Co-authored-by: zsx <[email protected]> Co-authored-by: Devin Robison <[email protected]>
* fix(dotenv): block workspace runtime env vars Co-authored-by: zsx <[email protected]> * docs(changelog): add workspace dotenv runtime-control entry * fix(dotenv): block workspace gateway port override --------- Co-authored-by: zsx <[email protected]> Co-authored-by: Devin Robison <[email protected]>
* fix(dotenv): block workspace runtime env vars Co-authored-by: zsx <[email protected]> * docs(changelog): add workspace dotenv runtime-control entry * fix(dotenv): block workspace gateway port override --------- Co-authored-by: zsx <[email protected]> Co-authored-by: Devin Robison <[email protected]>
2 participants
Summary
.envfiltering for runtime-control variables that should not be accepted from untrusted repositories.envbehavior unchangedChanges
.envdenylist insrc/infra/dotenv.tsto cover current runtime-control variables and control-family prefixessrc/infra/dotenv.test.tsfor blocked runtime-control variables and allowed user-defined passthrough variablesValidation
corepack pnpm test src/infra/dotenv.test.tspnpm checkvia the pre-commit hook duringscripts/committerclaude -p "/review"flow was not usable here because it tried to invoke GitHub commands under its own permission assumptionsNotes
.envfor these runtime-control variables should move them to the trusted global~/.openclaw/.envsurface instead