fix(extensions): prompt for consent on environment changes and sanitize runtime-altering environment variables - #28863
fix(extensions): prompt for consent on environment changes and sanitize runtime-altering environment variables#28863amelidev wants to merge 4 commits into
Conversation
…ze runtime-altering environment variables This change prevents silent injection of execution environments during extension updates by: 1. Printing custom environment variables in the extension installation/update consent string, which triggers a consent confirmation prompt if any environment variables are modified or added. 2. Sanitizing custom environment variables passed to stdio/local MCP servers, explicitly blocking execution-altering keys (e.g. NODE_OPTIONS, PYTHONPATH) to ensure child processes are launched safely.
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request strengthens the security posture of extension management by ensuring that modifications to environment variables are subject to user consent and by preventing the injection of potentially malicious execution-altering environment variables into spawned MCP server processes. Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
|
📊 PR Size: size/M
|
🛑 Action Required: Evaluation ApprovalSteering changes have been detected in this PR. To prevent regressions, a maintainer must approve the evaluation run before this PR can be merged. Maintainers:
Once approved, the evaluation results will be posted here automatically. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request enhances security by blocking dangerous environment variables (such as NODE_OPTIONS and PYTHONPATH) from being passed to MCP servers, and updates the consent flow to display configured environment variables. The review feedback recommends expanding the blocked environment variables list to include critical dynamic linker variables (e.g., LD_PRELOAD, LD_LIBRARY_PATH) and shell preloads (e.g., BASH_ENV) to prevent potential arbitrary code execution (RCE) bypasses.
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request introduces environment variable filtering for MCP server configurations to block dangerous variables (such as NODE_OPTIONS and PYTHONPATH) and updates the consent flow and tests accordingly. The feedback highlights that the blocklist is incomplete and misses critical system-level variables like LD_PRELOAD and DYLD_LIBRARY_PATH which could lead to remote code execution. It is recommended to expand this blocklist, centralize the sanitization logic, and update the corresponding unit tests to verify these additional blocked variables.
gemini-cli
Bot
added
the
status/need-issue
This change addresses PR review feedback by: 1. Centralizing the environment variable blocklist and helper inside environmentSanitization.ts. 2. Expanding the blocked list to cover critical OS-level dynamic preloads and execution-altering variables (e.g., LD_PRELOAD, DYLD_LIBRARY_PATH, BASH_ENV, ENV, PERL5DB). 3. Ensuring stdio-based MCP servers expand configurations using sanitizedEnv instead of raw process.env to prevent credential/secret leaks. 4. Adding robust unit tests to verify the expanded blocklist and secure variable expansion.
1 participant
Summary
This PR addresses an issue where extension updates could bypass user consent checks and inject unauthorized environment variables into spawned MCP server processes.
By incorporating MCP server environment configurations into the generated consent strings and sanitizing custom environment variables, we ensure that:
NODE_OPTIONS).Details
packages/cli/src/config/extensions/consent.ts, custom environment variables defined in the extension manifest are now included in the string output generated byextensionConsentString. Because the update system compares the previous version's consent string to the new version's consent string to decide whether to prompt the user, modifyingenvkeys now correctly forces a consent verification dialog.packages/core/src/tools/mcp-client.ts, we introduced a set of blocked execution-altering environment variables (includingNODE_OPTIONS,PYTHONPATH,RUBYOPT, andPERL5OPT). During MCP server environment merging, any key matching the blocked set is ignored and logged as a warning.packages/cli/src/config/extensions/consent.test.tsto verify that modifying an MCP server's environment configuration correctly triggers a consent prompt.packages/core/src/tools/mcp-client.test.tsto verify that dangerous environment variables are stripped from the environment dictionary before spawning the child transport.Related Issues
Resolves the reported extension consent bypass and unauthorized environment preload injection issues.
How to Validate
npm test -w @google/gemini-cli -- src/config/extensions/consent.test.ts --runnpm test -w @google/gemini-cli-core -- src/tools/mcp-client.test.ts --runnpm run lint && npm run typecheckPre-Merge Checklist