fix(backend): opt in to simple-git unsafe categories present in env#1193
Merged
Conversation
simple-git 3.36.0 (upgrade for CVE-2026-6951) now throws when the parent process environment contains values it considers unsafe — most commonly PAGER and EDITOR from the operator's shell, but also legit operator-set values like GIT_SSH_COMMAND for deploy keys. This broke git clone/fetch out of the box. Parse process.env once at module load with @simple-git/argv-parser, derive an `unsafe` flag map from whatever categories are present, and pass it to simpleGit(). When any are detected, emit a warn log listing the categories and messages along with a link to simple-git's unsafe actions doc so operators can see what's being trusted. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This comment has been minimized.
This comment has been minimized.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Contributor
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughParses process.env with ChangesUnsafe Category Configuration
🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
packages/backend/src/git.ts (1)
20-31: ⚡ Quick winConsider error handling around
parseEnv.The
parseEnvcall executes at module load time without error handling. If it throws, the entire git module will fail to load, preventing the backend from starting. While this fail-fast behavior may be intentional, defensive error handling could provide a better fallback experience.🛡️ Proposed error handling
-const { vulnerabilities: envVulnerabilities } = parseEnv(process.env); -const unsafe = Object.fromEntries( - envVulnerabilities.map(v => [v.category, true] as const) -); +let unsafe: Record<string, boolean> = {}; +let envVulnerabilities: Array<{ category: string; message: string }> = []; + +try { + const parsed = parseEnv(process.env); + envVulnerabilities = parsed.vulnerabilities; + unsafe = Object.fromEntries( + envVulnerabilities.map(v => [v.category, true] as const) + ); +} catch (error) { + logger.error('Failed to parse environment for unsafe git categories:', error); + logger.warn('Proceeding without unsafe category detection. Git operations may fail if environment contains blocked variables.'); +} if (envVulnerabilities.length > 0) {🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/backend/src/git.ts` around lines 20 - 31, Wrap the parseEnv(process.env) call in a try/catch so module load doesn’t throw: call parseEnv inside a try, on success use its vulnerabilities to build envVulnerabilities and unsafe as before; on error catch the exception, call logger.error including the error and fall back to envVulnerabilities = [] and unsafe = {} (or Object.fromEntries([])) so the rest of the file can continue and the existing logger.warn block only runs when envVulnerabilities.length > 0; reference parseEnv, envVulnerabilities, unsafe, and logger.warn when implementing the change.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CHANGELOG.md`:
- Around line 22-24: Move the "### Added" section so it appears before the "###
Changed" and "### Fixed" sections to follow the Keep a Changelog order;
specifically, relocate the block starting with the "### Added" header (the entry
about the startup warning for simple-git unsafe env vars) so the sections read:
Added, Changed, Deprecated, Removed, Fixed, Security.
---
Nitpick comments:
In `@packages/backend/src/git.ts`:
- Around line 20-31: Wrap the parseEnv(process.env) call in a try/catch so
module load doesn’t throw: call parseEnv inside a try, on success use its
vulnerabilities to build envVulnerabilities and unsafe as before; on error catch
the exception, call logger.error including the error and fall back to
envVulnerabilities = [] and unsafe = {} (or Object.fromEntries([])) so the rest
of the file can continue and the existing logger.warn block only runs when
envVulnerabilities.length > 0; reference parseEnv, envVulnerabilities, unsafe,
and logger.warn when implementing the change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 143b8c84-48a8-4770-92e0-1307b264da4d
📒 Files selected for processing (2)
CHANGELOG.mdpackages/backend/src/git.ts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
3.36.0(the CVE-2026-6951 upgrade) introduced a hardening layer via@simple-git/argv-parserthat throws when the parent process environment contains values it deems unsafe. This includes very common shell vars likePAGERandEDITOR, as well as legitimate operator-set values likeGIT_SSH_COMMAND(deploy-key setups),GIT_SSL_NO_VERIFY(referenced in #766), etc. The result wasgit clone/fetchfailing withUse of "PAGER" is not permitted without enabling allowUnsafePager(and similar) on any host with these set.process.envonce at module load usingparseEnvfrom@simple-git/argv-parserand reflects the resulting categories back into simple-git'sunsafeoption, so whatever the operator's environment contains is trusted by default. When any unsafe values are detected, alogger.warnlists the categories and messages, with a link to simple-git's unsafe-actions doc, so the trust isn't silent.Test plan
PAGER=lessset, run a clone and confirm it succeeds (was failing pre-fix).PAGER/EDITORare set.🤖 Generated with Claude Code
Summary by CodeRabbit