mirror of
https://github.com/openclaw/openclaw.git
synced 2026-04-13 18:21:27 +00:00
fa82193c72
* fix(env): block inherited host exec config vars * fix(env): preserve trusted inherited proxy env * fix(env): preserve inherited host exec vars * fix(env): refresh host env policy parity artifacts * test(env): align blocked override ordering * docs(changelog): add host env policy parity entry --------- Co-authored-by: Devin Robison <drobison@nvidia.com>
186 lines
4.4 KiB
Swift
186 lines
4.4 KiB
Swift
// Generated file. Do not edit directly.
|
|
// Source: src/infra/host-env-security-policy.json
|
|
// Regenerate: node scripts/generate-host-env-security-policy-swift.mjs --write
|
|
|
|
import Foundation
|
|
|
|
enum HostEnvSecurityPolicy {
|
|
static let blockedKeys: Set<String> = [
|
|
"_JAVA_OPTIONS",
|
|
"ANT_OPTS",
|
|
"BASH_ENV",
|
|
"BROWSER",
|
|
"CARGO_BUILD_RUSTC",
|
|
"CARGO_BUILD_RUSTC_WRAPPER",
|
|
"CC",
|
|
"CMAKE_C_COMPILER",
|
|
"CMAKE_CXX_COMPILER",
|
|
"CXX",
|
|
"DOTNET_ADDITIONAL_DEPS",
|
|
"DOTNET_STARTUP_HOOKS",
|
|
"ENV",
|
|
"GCONV_PATH",
|
|
"GIT_ALTERNATE_OBJECT_DIRECTORIES",
|
|
"GIT_COMMON_DIR",
|
|
"GIT_DIR",
|
|
"GIT_EDITOR",
|
|
"GIT_EXEC_PATH",
|
|
"GIT_EXTERNAL_DIFF",
|
|
"GIT_INDEX_FILE",
|
|
"GIT_NAMESPACE",
|
|
"GIT_OBJECT_DIRECTORY",
|
|
"GIT_SEQUENCE_EDITOR",
|
|
"GIT_SSL_CAINFO",
|
|
"GIT_SSL_CAPATH",
|
|
"GIT_SSL_NO_VERIFY",
|
|
"GIT_TEMPLATE_DIR",
|
|
"GIT_WORK_TREE",
|
|
"GLIBC_TUNABLES",
|
|
"GRADLE_OPTS",
|
|
"HGRCPATH",
|
|
"IFS",
|
|
"JAVA_OPTS",
|
|
"JAVA_TOOL_OPTIONS",
|
|
"JDK_JAVA_OPTIONS",
|
|
"MAKEFLAGS",
|
|
"MAVEN_OPTS",
|
|
"MFLAGS",
|
|
"NODE_OPTIONS",
|
|
"NODE_PATH",
|
|
"PERL5LIB",
|
|
"PERL5OPT",
|
|
"PS4",
|
|
"PYTHONBREAKPOINT",
|
|
"PYTHONHOME",
|
|
"PYTHONPATH",
|
|
"RUBYLIB",
|
|
"RUBYOPT",
|
|
"RUSTC_WRAPPER",
|
|
"SBT_OPTS",
|
|
"SHELL",
|
|
"SHELLOPTS",
|
|
"SSLKEYLOGFILE"
|
|
]
|
|
|
|
static let blockedOverrideKeys: Set<String> = [
|
|
"ALL_PROXY",
|
|
"AWS_CONFIG_FILE",
|
|
"AWS_SHARED_CREDENTIALS_FILE",
|
|
"AWS_WEB_IDENTITY_TOKEN_FILE",
|
|
"AZURE_AUTH_LOCATION",
|
|
"BUN_CONFIG_REGISTRY",
|
|
"BUNDLE_GEMFILE",
|
|
"C_INCLUDE_PATH",
|
|
"CARGO_BUILD_RUSTC_WRAPPER",
|
|
"CARGO_HOME",
|
|
"CGO_CFLAGS",
|
|
"CGO_LDFLAGS",
|
|
"CLASSPATH",
|
|
"COMPOSER_HOME",
|
|
"CORECLR_PROFILER_PATH",
|
|
"CPATH",
|
|
"CPLUS_INCLUDE_PATH",
|
|
"CURL_CA_BUNDLE",
|
|
"CURL_HOME",
|
|
"DENO_DIR",
|
|
"DOCKER_CERT_PATH",
|
|
"DOCKER_CONTEXT",
|
|
"DOCKER_HOST",
|
|
"DOCKER_TLS_VERIFY",
|
|
"EDITOR",
|
|
"FCEDIT",
|
|
"GEM_HOME",
|
|
"GEM_PATH",
|
|
"GIT_ALTERNATE_OBJECT_DIRECTORIES",
|
|
"GIT_ASKPASS",
|
|
"GIT_COMMON_DIR",
|
|
"GIT_DIR",
|
|
"GIT_INDEX_FILE",
|
|
"GIT_NAMESPACE",
|
|
"GIT_OBJECT_DIRECTORY",
|
|
"GIT_PAGER",
|
|
"GIT_PROXY_COMMAND",
|
|
"GIT_SSH",
|
|
"GIT_SSH_COMMAND",
|
|
"GIT_SSL_CAINFO",
|
|
"GIT_SSL_CAPATH",
|
|
"GIT_SSL_NO_VERIFY",
|
|
"GIT_WORK_TREE",
|
|
"GOENV",
|
|
"GOFLAGS",
|
|
"GONOPROXY",
|
|
"GONOSUMCHECK",
|
|
"GONOSUMDB",
|
|
"GOOGLE_APPLICATION_CREDENTIALS",
|
|
"GOPATH",
|
|
"GOPRIVATE",
|
|
"GOPROXY",
|
|
"GRADLE_USER_HOME",
|
|
"HELM_HOME",
|
|
"HGRCPATH",
|
|
"HISTFILE",
|
|
"HOME",
|
|
"HTTP_PROXY",
|
|
"HTTPS_PROXY",
|
|
"KUBECONFIG",
|
|
"LESSCLOSE",
|
|
"LESSOPEN",
|
|
"LIBRARY_PATH",
|
|
"LUA_CPATH",
|
|
"LUA_PATH",
|
|
"MAKEFLAGS",
|
|
"MANPAGER",
|
|
"MFLAGS",
|
|
"NO_PROXY",
|
|
"NODE_EXTRA_CA_CERTS",
|
|
"NODE_TLS_REJECT_UNAUTHORIZED",
|
|
"OBJC_INCLUDE_PATH",
|
|
"OPENSSL_CONF",
|
|
"OPENSSL_ENGINES",
|
|
"PAGER",
|
|
"PERL5DB",
|
|
"PERL5DBCMD",
|
|
"PHP_INI_SCAN_DIR",
|
|
"PHPRC",
|
|
"PIP_CONFIG_FILE",
|
|
"PIP_EXTRA_INDEX_URL",
|
|
"PIP_FIND_LINKS",
|
|
"PIP_INDEX_URL",
|
|
"PIP_PYPI_URL",
|
|
"PIP_TRUSTED_HOST",
|
|
"PROMPT_COMMAND",
|
|
"PYTHONSTARTUP",
|
|
"PYTHONUSERBASE",
|
|
"REQUESTS_CA_BUNDLE",
|
|
"RUSTC_WRAPPER",
|
|
"RUSTFLAGS",
|
|
"SSH_ASKPASS",
|
|
"SSL_CERT_DIR",
|
|
"SSL_CERT_FILE",
|
|
"SUDO_EDITOR",
|
|
"UV_DEFAULT_INDEX",
|
|
"UV_EXTRA_INDEX_URL",
|
|
"UV_INDEX",
|
|
"UV_INDEX_URL",
|
|
"UV_PYTHON",
|
|
"VIRTUAL_ENV",
|
|
"VISUAL",
|
|
"WGETRC",
|
|
"XDG_CONFIG_HOME",
|
|
"YARN_RC_FILENAME",
|
|
"ZDOTDIR"
|
|
]
|
|
|
|
static let blockedOverridePrefixes: [String] = [
|
|
"CARGO_REGISTRIES_",
|
|
"GIT_CONFIG_",
|
|
"NPM_CONFIG_"
|
|
]
|
|
|
|
static let blockedPrefixes: [String] = [
|
|
"BASH_FUNC_",
|
|
"DYLD_",
|
|
"LD_"
|
|
]
|
|
}
|