Security fix: Disable external extension loading by default (RUN-3540)

- Changed RD_EXT_DISABLED default from false to true in Main.java
- Extension directory loading now disabled by default to prevent arbitrary code execution
- Users must explicitly set RD_EXT_DISABLED=false to enable external extensions
- Updated CHANGELOG.md for version 2.0.10
- Added MainSpec test for Main class constants
- Updated .gitignore to exclude bin/ directories

Addresses security vulnerability where malicious JAR files could be loaded
via RD_EXT_DIR environment variable, executing code through static initializers
without user interaction.

Author: fdevans

.gitignore

@@ -2,6 +2,8 @@
 /.idea
 /build
 */build
+/bin
+*/bin
 */out
 *.ipr
 *.iml

CHANGELOG.md

@@ -1,3 +1,9 @@
+## 2.0.10
+
+* **Security Fix**: External extension directory loading is now disabled by default to prevent arbitrary code execution vulnerability. To enable extension loading from external directories, set environment variable `RD_EXT_DISABLED=false`. (Addresses RUN-3540)
+
+[Changes](https://github.com/rundeck/rundeck-cli/compare/v2.0.9...v2.0.10)
+
 ## 2.0.9
 
 * fix: NPE if system info does not return all data

rd-cli-tool/src/main/java/org/rundeck/client/tool/Main.java

@@ -196,7 +196,7 @@ private static ConfigSource buildConfig() {
     }
 
     private static void loadExtensionJars(ConfigSource config) {
-        if (config.getBool(RD_EXT_DISABLED, false)) {
+        if (config.getBool(RD_EXT_DISABLED, true)) {
             return;
         }
         String rd_ext_dir = config.get(RD_EXT_DIR);

rd-cli-tool/src/test/groovy/org/rundeck/client/tool/MainSpec.groovy

@@ -0,0 +1,22 @@
+package org.rundeck.client.tool
+
+import spock.lang.Specification
+
+/**
+ * Test for Main class
+ * Note: Extension loading security behavior is tested through integration tests
+ * and verified by the default value of RD_EXT_DISABLED in Main.java
+ */
+class MainSpec extends Specification {
+    
+    def "RD_EXT_DISABLED constant is defined"() {
+        expect: "RD_EXT_DISABLED constant exists"
+        Main.RD_EXT_DISABLED == "RD_EXT_DISABLED"
+    }
+    
+    def "RD_EXT_DIR constant is defined"() {
+        expect: "RD_EXT_DIR constant exists"
+        Main.RD_EXT_DIR == "RD_EXT_DIR"
+    }
+}
+