fix(patch): cherry-pick 7ec477d to release/v0.33.0-preview.3-pr-21305 to patch version v0.33.0-preview.3 and create version 0.33.0-preview.4#21349
Conversation
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request integrates support for a new AI API Gateway authentication type, enabling more flexible and customizable connections to AI services. It extends the existing authentication mechanisms to include gateway-specific configurations, ensuring that users can route their requests through a designated gateway with custom headers and a base URL. This enhancement provides greater control and adaptability for diverse deployment scenarios. Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
|
Size Change: +1.58 kB (+0.01%) Total Size: 25.9 MB
ℹ️ View Unchanged
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new 'gateway' authentication method, allowing users to connect to a custom AI API gateway by providing a baseUrl and custom headers. While the implementation across the cli and core packages, including zod schema validation and unit tests, is generally robust, a critical security flaw has been identified. In acpClient.ts, internal state is updated with untrusted values before authentication is verified. This could allow a malicious client to redirect AI requests to an attacker-controlled server, even if a standard authentication method is selected. This vulnerability must be addressed.
| if (apiKey) { | ||
| this.apiKey = apiKey; | ||
| } | ||
| await this.config.refreshAuth(method, apiKey ?? this.apiKey); | ||
|
|
||
| // Extract gateway details if present | ||
| const gatewaySchema = z.object({ | ||
| baseUrl: z.string().optional(), | ||
| headers: z.record(z.string()).optional(), | ||
| }); | ||
|
|
||
| let baseUrl: string | undefined; | ||
| let headers: Record<string, string> | undefined; | ||
|
|
||
| if (meta?.['gateway']) { | ||
| const result = gatewaySchema.safeParse(meta['gateway']); | ||
| if (result.success) { | ||
| baseUrl = result.data.baseUrl; | ||
| headers = result.data.headers; | ||
| } else { | ||
| throw new acp.RequestError( | ||
| -32602, | ||
| `Malformed gateway payload: ${result.error.message}`, | ||
| ); | ||
| } | ||
| } | ||
|
|
||
| this.baseUrl = baseUrl; | ||
| this.customHeaders = headers; |
There was a problem hiding this comment.
The authenticate method updates the agent's internal state (this.apiKey, this.baseUrl, and this.customHeaders) before successfully completing the authentication process via this.config.refreshAuth. If refreshAuth fails (e.g., due to an invalid API key or an unreachable gateway), the agent is left with these untrusted configuration values in its memory.
These values are subsequently used in newSession and other methods. This creates a vulnerability where a malicious client can send a failed authenticate request to "poison" the agent's configuration. For example, an attacker could set a malicious baseUrl in a failed authentication attempt. If the user later starts a new session using a standard authentication method (like USE_GEMINI), the agent will use the malicious baseUrl from the previous failed attempt, effectively redirecting the user's AI requests and potentially leaking their real API key and chat history to the attacker's gateway.
To remediate this, update the internal state only after this.config.refreshAuth has successfully completed.
References
- Security-sensitive settings should not use a merge strategy that allows less-trusted configuration scopes (like a workspace) to completely override more-trusted scopes (like global user settings). This comment highlights a similar issue where untrusted input from a failed authentication attempt can 'poison' security-sensitive internal state, effectively overriding it.
gemini-cli
Bot
added
the
status/need-issue
galdawave
merged commit 7e6e40c
into
release/v0.33.0-preview.3-pr-21305
galdawave
deleted the
hotfix/v0.33.0-preview.3/0.33.0-preview.4/preview/cherry-pick-7ec477d/pr-21305
branch
4 participants
This PR automatically cherry-picks commit 7ec477d to patch version v0.33.0-preview.3 in the preview release to create version 0.33.0-preview.4.