Skip to content

Commit 975b7dc

Browse files
gemini-cli-robotgaldawave
gemini-cli-robot
and
galdawave
authored
fix(patch): cherry-pick 765fb67 to release/v0.36.0-preview.5-pr-24055 to patch version v0.36.0-preview.5 and create version 0.36.0-preview.6 (#24061)
Co-authored-by: Gal Zahavi <38544478+galz10@users.noreply.github.com>
1 parent c1af5ab commit 975b7dc

6 files changed

Lines changed: 42 additions & 29 deletions

File tree

‎packages/cli/src/config/sandboxConfig.test.ts‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ describe('loadSandboxConfig', () => {
9393
expect(config).toEqual({
9494
enabled: true,
9595
allowedPaths: [],
96-
networkAccess: false,
96+
networkAccess: true,
9797
command: 'docker',
9898
image: 'default/image',
9999
});
@@ -122,7 +122,7 @@ describe('loadSandboxConfig', () => {
122122
expect(config).toEqual({
123123
enabled: true,
124124
allowedPaths: [],
125-
networkAccess: false,
125+
networkAccess: true,
126126
command: 'lxc',
127127
image: 'default/image',
128128
});
@@ -148,7 +148,7 @@ describe('loadSandboxConfig', () => {
148148
expect(config).toEqual({
149149
enabled: true,
150150
allowedPaths: [],
151-
networkAccess: false,
151+
networkAccess: true,
152152
command: 'sandbox-exec',
153153
image: 'default/image',
154154
});
@@ -161,7 +161,7 @@ describe('loadSandboxConfig', () => {
161161
expect(config).toEqual({
162162
enabled: true,
163163
allowedPaths: [],
164-
networkAccess: false,
164+
networkAccess: true,
165165
command: 'sandbox-exec',
166166
image: 'default/image',
167167
});
@@ -174,7 +174,7 @@ describe('loadSandboxConfig', () => {
174174
expect(config).toEqual({
175175
enabled: true,
176176
allowedPaths: [],
177-
networkAccess: false,
177+
networkAccess: true,
178178
command: 'docker',
179179
image: 'default/image',
180180
});
@@ -187,7 +187,7 @@ describe('loadSandboxConfig', () => {
187187
expect(config).toEqual({
188188
enabled: true,
189189
allowedPaths: [],
190-
networkAccess: false,
190+
networkAccess: true,
191191
command: 'podman',
192192
image: 'default/image',
193193
});
@@ -210,7 +210,7 @@ describe('loadSandboxConfig', () => {
210210
expect(config).toEqual({
211211
enabled: true,
212212
allowedPaths: [],
213-
networkAccess: false,
213+
networkAccess: true,
214214
command: 'podman',
215215
image: 'default/image',
216216
});
@@ -244,7 +244,7 @@ describe('loadSandboxConfig', () => {
244244
expect(config).toEqual({
245245
enabled: true,
246246
allowedPaths: [],
247-
networkAccess: false,
247+
networkAccess: true,
248248
command: 'docker',
249249
image: 'env/image',
250250
});
@@ -257,7 +257,7 @@ describe('loadSandboxConfig', () => {
257257
expect(config).toEqual({
258258
enabled: true,
259259
allowedPaths: [],
260-
networkAccess: false,
260+
networkAccess: true,
261261
command: 'docker',
262262
image: 'default/image',
263263
});
@@ -285,7 +285,7 @@ describe('loadSandboxConfig', () => {
285285
expect(config).toEqual({
286286
enabled: true,
287287
allowedPaths: [],
288-
networkAccess: false,
288+
networkAccess: true,
289289
command: 'docker',
290290
image: 'default/image',
291291
});
@@ -339,7 +339,7 @@ describe('loadSandboxConfig', () => {
339339
enabled: true,
340340
command: 'podman',
341341
allowedPaths: [],
342-
networkAccess: false,
342+
networkAccess: true,
343343
},
344344
},
345345
},
@@ -356,7 +356,7 @@ describe('loadSandboxConfig', () => {
356356
enabled: true,
357357
image: 'custom/image',
358358
allowedPaths: [],
359-
networkAccess: false,
359+
networkAccess: true,
360360
},
361361
},
362362
},
@@ -372,7 +372,7 @@ describe('loadSandboxConfig', () => {
372372
sandbox: {
373373
enabled: false,
374374
allowedPaths: [],
375-
networkAccess: false,
375+
networkAccess: true,
376376
},
377377
},
378378
},
@@ -388,7 +388,7 @@ describe('loadSandboxConfig', () => {
388388
sandbox: {
389389
enabled: true,
390390
allowedPaths: ['/settings-path'],
391-
networkAccess: false,
391+
networkAccess: true,
392392
},
393393
},
394394
},
@@ -410,7 +410,7 @@ describe('loadSandboxConfig', () => {
410410
expect(config).toEqual({
411411
enabled: true,
412412
allowedPaths: [],
413-
networkAccess: false,
413+
networkAccess: true,
414414
command: 'runsc',
415415
image: 'default/image',
416416
});
@@ -425,7 +425,7 @@ describe('loadSandboxConfig', () => {
425425
expect(config).toEqual({
426426
enabled: true,
427427
allowedPaths: [],
428-
networkAccess: false,
428+
networkAccess: true,
429429
command: 'runsc',
430430
image: 'default/image',
431431
});
@@ -442,7 +442,7 @@ describe('loadSandboxConfig', () => {
442442
expect(config).toEqual({
443443
enabled: true,
444444
allowedPaths: [],
445-
networkAccess: false,
445+
networkAccess: true,
446446
command: 'runsc',
447447
image: 'default/image',
448448
});
@@ -460,7 +460,7 @@ describe('loadSandboxConfig', () => {
460460
expect(config).toEqual({
461461
enabled: true,
462462
allowedPaths: [],
463-
networkAccess: false,
463+
networkAccess: true,
464464
command: 'runsc',
465465
image: 'default/image',
466466
});

‎packages/cli/src/config/sandboxConfig.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,7 @@ export async function loadSandboxConfig(
131131

132132
let sandboxValue: boolean | string | null | undefined;
133133
let allowedPaths: string[] = [];
134-
let networkAccess = false;
134+
let networkAccess = true;
135135
let customImage: string | undefined;
136136

137137
if (
@@ -142,7 +142,7 @@ export async function loadSandboxConfig(
142142
const config = sandboxOption;
143143
sandboxValue = config.enabled ? (config.command ?? true) : false;
144144
allowedPaths = config.allowedPaths ?? [];
145-
networkAccess = config.networkAccess ?? false;
145+
networkAccess = config.networkAccess ?? true;
146146
customImage = config.image;
147147
} else if (typeof sandboxOption !== 'object' || sandboxOption === null) {
148148
sandboxValue = sandboxOption;

‎packages/core/src/sandbox/macos/MacOsSandboxManager.test.ts‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -153,7 +153,10 @@ describe('MacOsSandboxManager', () => {
153153
SAFE_VAR: '1',
154154
GITHUB_TOKEN: 'sensitive',
155155
},
156-
policy: mockPolicy,
156+
policy: {
157+
...mockPolicy,
158+
sanitizationConfig: { enableEnvironmentVariableRedaction: true },
159+
},
157160
});
158161

159162
expect(result.env['SAFE_VAR']).toBe('1');

‎packages/core/src/services/environmentSanitization.test.ts‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -375,9 +375,9 @@ describe('sanitizeEnvironment', () => {
375375
});
376376

377377
describe('getSecureSanitizationConfig', () => {
378-
it('should enable environment variable redaction by default', () => {
378+
it('should default enableEnvironmentVariableRedaction to false', () => {
379379
const config = getSecureSanitizationConfig();
380-
expect(config.enableEnvironmentVariableRedaction).toBe(true);
380+
expect(config.enableEnvironmentVariableRedaction).toBe(false);
381381
});
382382

383383
it('should merge allowed and blocked variables from base and requested configs', () => {
@@ -440,13 +440,13 @@ describe('getSecureSanitizationConfig', () => {
440440
expect(config.blockedEnvironmentVariables).toEqual(['BLOCKED_VAR']);
441441
});
442442

443-
it('should force enableEnvironmentVariableRedaction to true even if requested false', () => {
443+
it('should respect requested enableEnvironmentVariableRedaction value', () => {
444444
const requestedConfig = {
445445
enableEnvironmentVariableRedaction: false,
446446
};
447447

448448
const config = getSecureSanitizationConfig(requestedConfig);
449449

450-
expect(config.enableEnvironmentVariableRedaction).toBe(true);
450+
expect(config.enableEnvironmentVariableRedaction).toBe(false);
451451
});
452452
});

‎packages/core/src/services/environmentSanitization.ts‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -230,6 +230,9 @@ export function getSecureSanitizationConfig(
230230
allowedEnvironmentVariables: [...new Set(allowed)],
231231
blockedEnvironmentVariables: [...new Set(blocked)],
232232
// Redaction must be enabled for secure configurations
233-
enableEnvironmentVariableRedaction: true,
233+
enableEnvironmentVariableRedaction:
234+
requestedConfig.enableEnvironmentVariableRedaction ??
235+
baseConfig?.enableEnvironmentVariableRedaction ??
236+
false,
234237
};
235238
}

‎packages/core/src/services/sandboxManager.test.ts‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,11 @@ describe('NoopSandboxManager', () => {
5858
MY_SECRET: 'super-secret',
5959
SAFE_VAR: 'is-safe',
6060
},
61+
policy: {
62+
sanitizationConfig: {
63+
enableEnvironmentVariableRedaction: true,
64+
},
65+
},
6166
};
6267

6368
const result = await sandboxManager.prepareCommand(req);
@@ -68,7 +73,7 @@ describe('NoopSandboxManager', () => {
6873
expect(result.env['MY_SECRET']).toBeUndefined();
6974
});
7075

71-
it('should NOT allow disabling environment variable redaction if requested in config (vulnerability fix)', async () => {
76+
it('should allow disabling environment variable redaction if requested in config', async () => {
7277
const req = {
7378
command: 'echo',
7479
args: ['hello'],
@@ -85,8 +90,8 @@ describe('NoopSandboxManager', () => {
8590

8691
const result = await sandboxManager.prepareCommand(req);
8792

88-
// API_KEY should be redacted because SandboxManager forces redaction and API_KEY matches NEVER_ALLOWED_NAME_PATTERNS
89-
expect(result.env['API_KEY']).toBeUndefined();
93+
// API_KEY should be preserved because redaction was explicitly disabled
94+
expect(result.env['API_KEY']).toBe('sensitive-key');
9095
});
9196

9297
it('should respect allowedEnvironmentVariables in config but filter sensitive ones', async () => {
@@ -101,6 +106,7 @@ describe('NoopSandboxManager', () => {
101106
policy: {
102107
sanitizationConfig: {
103108
allowedEnvironmentVariables: ['MY_SAFE_VAR', 'MY_TOKEN'],
109+
enableEnvironmentVariableRedaction: true,
104110
},
105111
},
106112
};
@@ -124,6 +130,7 @@ describe('NoopSandboxManager', () => {
124130
policy: {
125131
sanitizationConfig: {
126132
blockedEnvironmentVariables: ['BLOCKED_VAR'],
133+
enableEnvironmentVariableRedaction: true,
127134
},
128135
},
129136
};

0 commit comments

Comments
 (0)