fix: add MCP input validation and filter env vars in script-runner#31
Merged
jcanizalez merged 3 commits intomainfrom Mar 14, 2026
Merged
fix: add MCP input validation and filter env vars in script-runner#31jcanizalez merged 3 commits intomainfrom
jcanizalez merged 3 commits intomainfrom
Conversation
script-runner.ts passed raw process.env to spawned scripts, leaking all environment variables (API keys, tokens, credentials) to user scripts. ide-detector.ts spawned IDE processes without specifying env, which defaults to inheriting process.env. Both now use getSafeEnv() which filters out sensitive prefixes (AWS_SECRET, GITHUB_TOKEN, ANTHROPIC_API, STRIPE_, etc.) matching the same pattern already used by pty-manager, headless-manager, and agent-detector.
There was a problem hiding this comment.
Pull request overview
This PR reduces the risk of leaking sensitive environment variables by ensuring subprocesses spawned by the server use getSafeEnv() (from process-utils.ts) instead of inheriting the full process.env.
Changes:
- Update
script-runnerto spawn bash/python/node/powershell scripts withenv: getSafeEnv(). - Update
ide-detectorto spawn IDE launch processes withenv: getSafeEnv().
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| packages/server/src/script-runner.ts | Stops passing full process.env to spawned scripts by switching to getSafeEnv(). |
| packages/server/src/ide-detector.ts | Ensures IDE processes are spawned with filtered env via getSafeEnv(). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
Comment on lines
+118
to
+122
| const spawnOpts: import('node:child_process').SpawnOptions = { | ||
| detached: true, | ||
| stdio: 'ignore', | ||
| env: getSafeEnv() | ||
| } |
Previously all MCP tool inputs used bare z.string() with no length limits or content validation. This allowed: - Unbounded strings (title, description) causing resource exhaustion - Path traversal in project_name (../../../etc/passwd) - Arbitrary-length prompts and terminal writes - Invalid hex colors and non-absolute paths Add shared validation module (packages/mcp/src/validation.ts) with bounded schemas for all input types: - name: 1-200 chars, no .. / \ (path traversal protection) - title: 1-500 chars - description: 0-5000 chars - prompt: 0-10000 chars - absolutePath: must start with / - hexColor: validated regex - id: 1-100 chars - shortText: 0-200 chars (branches, display names, icons) Applied across all 6 tool files: tasks, projects, sessions, workflows, git, and config.
jcanizalez
changed the title
jcanizalez
changed the title
The commandExists() helper used execFileSync without an explicit env, inheriting process.env with sensitive variables. Now uses getSafeEnv() to match the pattern already used in openInIDE().
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
MCP Input Validation
validation.tsmodule with bounded Zod schemas (V.name,V.title,V.description,V.id,V.absolutePath,V.hexColor,V.shortText,V.prompt)..,/,\Environment Variable Leak
script-runner.ts: replacedenv: process.envwithenv: getSafeEnv()to filter sensitive vars (API keys, credentials) from spawned scriptside-detector.ts: same fix for IDE detection subprocessTest plan
../../etc/passwd)