From dbb722a4800214ea1fe992050b3a9cfb9679591b Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Sat, 5 Sep 2026 21:16:06 +0000 Subject: [PATCH 1/3] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20Fix=20f?= =?UTF-8?q?ramework=20secrets=20leakage=20via=20execa=20extendEnv?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Use `sanitizeEnvironment` on the merged environment variables for `execa`. - Explicitly set `extendEnv: false` in `execa` options in `src/core/tools/capability/runner.ts` and `src/cli/authorization/non-interactive.ts`. - This ensures framework secrets like API keys do not leak to child processes. --- .jules/sentinel.md | 5 +++++ src/cli/authorization/non-interactive.ts | 4 ++++ src/core/tools/capability/runner.ts | 4 +++- 3 files changed, 12 insertions(+), 1 deletion(-) diff --git a/.jules/sentinel.md b/.jules/sentinel.md index 1446dff3..e56cddf2 100644 --- a/.jules/sentinel.md +++ b/.jules/sentinel.md @@ -12,3 +12,8 @@ **Vulnerability:** The redaction regex `KV_PATTERN` failed to match and redact quoted secret values (e.g., `password="mysecret"`), potentially leaking credentials in audit logs. **Learning:** Regular expressions for sanitizing key=value pairs must account for quoted values by explicitly including `"[^"]*"` and `'[^']*'` in the matching group. **Prevention:** When writing regex for secrets matching, always include patterns for both quoted and unquoted strings to prevent simple bypasses. + +## 2026-09-05 - Fix framework secrets leakage via execa extendEnv +**Vulnerability:** `execa` re-injects unsanitized `process.env` by default when `extendEnv` is true, causing framework secrets to leak into spawned processes. +**Learning:** Passing a sanitized environment object to `execa` is insufficient if `extendEnv: false` is not explicitly set, as `execa` merges the sanitized object with the unsanitized host `process.env`. +**Prevention:** Always explicitly set `extendEnv: false` when passing a sanitized environment object to `execa` in `src/core/tools/capability/runner.ts` and `src/cli/authorization/non-interactive.ts`. diff --git a/src/cli/authorization/non-interactive.ts b/src/cli/authorization/non-interactive.ts index 369e269b..983ad7a8 100644 --- a/src/cli/authorization/non-interactive.ts +++ b/src/cli/authorization/non-interactive.ts @@ -1,6 +1,8 @@ import { execa } from 'execa'; import { z } from 'zod'; +import { sanitizeEnvironment } from '../../core/utils/sanitizer.js'; + import type { AuthorizationDecision, ResolvedExtensions, @@ -100,6 +102,8 @@ export async function requestNonInteractiveAuthorizationDecision(params: { input: JSON.stringify({ request: params.request }), shell: true, timeout: timeoutMs, + env: sanitizeEnvironment(process.env), + extendEnv: false, reject: false, }); diff --git a/src/core/tools/capability/runner.ts b/src/core/tools/capability/runner.ts index dbba2080..d2e20ba2 100644 --- a/src/core/tools/capability/runner.ts +++ b/src/core/tools/capability/runner.ts @@ -1,5 +1,6 @@ import { execa } from 'execa'; +import { sanitizeEnvironment } from '../../utils/sanitizer.js'; import { ExecOpts, ExecResult } from './types.js'; /** @@ -15,7 +16,8 @@ export function createControlledRunner() { cwd: opts?.cwd, timeout: opts?.timeoutMs, maxBuffer: opts?.maxStdoutBytes, - env: opts?.env, + env: sanitizeEnvironment(opts?.env ? { ...process.env, ...opts.env } : process.env), + extendEnv: false, reject: false, // Backends should handle exit codes themselves }); From 6c997f892ab92cdb33df128a695ee3c44fd38568 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Sat, 5 Sep 2026 21:21:09 +0000 Subject: [PATCH 2/3] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20Fix=20f?= =?UTF-8?q?ramework=20secrets=20leakage=20via=20execa=20extendEnv?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Use `sanitizeEnvironment` on the merged environment variables for `execa`. - Explicitly set `extendEnv: false` in `execa` options in `src/core/tools/capability/runner.ts` and `src/cli/authorization/non-interactive.ts`. - This ensures framework secrets like API keys do not leak to child processes. - Fix lint errors related to import ordering. --- src/cli/authorization/non-interactive.ts | 2 +- src/core/tools/capability/runner.ts | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/src/cli/authorization/non-interactive.ts b/src/cli/authorization/non-interactive.ts index 983ad7a8..3c238935 100644 --- a/src/cli/authorization/non-interactive.ts +++ b/src/cli/authorization/non-interactive.ts @@ -1,7 +1,6 @@ import { execa } from 'execa'; import { z } from 'zod'; -import { sanitizeEnvironment } from '../../core/utils/sanitizer.js'; import type { AuthorizationDecision, @@ -15,6 +14,7 @@ import { McpConnectionManager, } from '../../core/facades/cli-authorization-non-interactive.js'; import { isRecord } from '../../core/facades/cli-utils-serialize.js'; +import { sanitizeEnvironment } from '../../core/utils/sanitizer.js'; import { text } from '../locales/index.js'; const DecisionSchema = z diff --git a/src/core/tools/capability/runner.ts b/src/core/tools/capability/runner.ts index d2e20ba2..91c71c9d 100644 --- a/src/core/tools/capability/runner.ts +++ b/src/core/tools/capability/runner.ts @@ -1,6 +1,7 @@ import { execa } from 'execa'; import { sanitizeEnvironment } from '../../utils/sanitizer.js'; + import { ExecOpts, ExecResult } from './types.js'; /** From 604a4bd2ce9bc9e568d04fad498af0be3d3e24c0 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Sat, 5 Sep 2026 21:24:47 +0000 Subject: [PATCH 3/3] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20Fix=20f?= =?UTF-8?q?ramework=20secrets=20leakage=20via=20execa=20extendEnv?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Use `sanitizeEnvironment` on the merged environment variables for `execa`. - Explicitly set `extendEnv: false` in `execa` options in `src/core/tools/capability/runner.ts` and `src/cli/authorization/non-interactive.ts`. - This ensures framework secrets like API keys do not leak to child processes. - Fix oxfmt formatting issues. --- src/cli/authorization/non-interactive.ts | 1 - 1 file changed, 1 deletion(-) diff --git a/src/cli/authorization/non-interactive.ts b/src/cli/authorization/non-interactive.ts index 3c238935..ed339e5d 100644 --- a/src/cli/authorization/non-interactive.ts +++ b/src/cli/authorization/non-interactive.ts @@ -1,7 +1,6 @@ import { execa } from 'execa'; import { z } from 'zod'; - import type { AuthorizationDecision, ResolvedExtensions,