Filter sensitive environment variables during Ruby evals

[MikeMcQuaid]

This provides a potential security improvement for untrusted Ruby code but has minimal enough overhead that we can just do it always. We may add an opt-out for this behaviour if it breaks things for people but it was already applied during install/test/postinstall blocks.

• Hide token-like environment variables while formulae and casks are evaluated so top-level DSL code cannot read them.
• Restore the caller environment after metadata loading and command parser requires so command execution keeps its normal environment.
• Cover formula, cask and external command require paths.

---

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same change?
• Have you added an explanation of what your changes do and why you'd like us to include them? Performance claims (e.g. "this is faster") must include Hyperfine benchmarks.
• Have you written new tests (excluding integration tests) for your changes? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) with your changes locally?

---

• AI was used to generate or assist with generating this PR. Please specify below how you used AI to help you, and what steps you have taken to manually verify the changes. Non-maintainers may only have one AI-assisted/generated PR open at a time.

OpenAI Codex 5.5 xhigh with local review and testing.

---

[Copilot]

Pull request overview

This PR tightens security during evaluation of untrusted Ruby code by temporarily removing “token-like” environment variables while formulae, casks, and external Ruby commands are eval’d/require’d, then restoring the original environment afterward so normal command execution still sees the caller’s environment.

Changes:

• Extend ENV.clear_sensitive_environment! to support a block form that restores the environment after yielding.
• Wrap formula and cask evaluation (module_eval / instance_eval) in ENV.clear_sensitive_environment! to prevent top-level DSL code from reading sensitive variables.
• Wrap external Ruby command loading (Homebrew.require?) in the same environment-scrubbing block and add test coverage for formula, cask, and brew help paths.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
Library/Homebrew/extend/ENV.rb	Adds block form to clear_sensitive_environment! with ensure-based restoration.
Library/Homebrew/formulary.rb	Scrubs sensitive env vars during formula module_eval loading.
Library/Homebrew/cask/cask_loader.rb	Scrubs sensitive env vars during cask instance_eval loading (content + path loaders).
Library/Homebrew/commands.rb	Scrubs sensitive env vars while require-loading external Ruby v2 commands.
Library/Homebrew/cli/parser.rb	Scrubs sensitive env vars while require-loading command parsers from Ruby command files.
Library/Homebrew/test/ENV_spec.rb	Adds spec verifying env restoration and non-persistence of block mutations.
Library/Homebrew/test/formulary_spec.rb	Adds spec ensuring formula top-level code can’t see sensitive env vars and env is restored.
Library/Homebrew/test/cask/cask_loader_spec.rb	Adds spec ensuring cask DSL evaluation can’t see sensitive env vars and env is restored.
Library/Homebrew/test/cmd/help_spec.rb	Adds integration coverage ensuring external command require doesn’t leak sensitive env vars.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.