From c25f3ea53e39978b988173934c26fcd6cd1754b8 Mon Sep 17 00:00:00 2001 From: Michael Bolin Date: Thu, 14 Aug 2025 13:57:15 -0700 Subject: [PATCH] fix: do not allow dotenv to create/modify environment variables starting with CODEX_ (#2308) This ensures Codex cannot drop a `.env` file with a value of `CODEX_HOME` that points to a folder that Codex can control. --- codex-rs/arg0/src/lib.rs | 28 ++++++++++++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-) diff --git a/codex-rs/arg0/src/lib.rs b/codex-rs/arg0/src/lib.rs index c097ebc1..b7766fe7 100644 --- a/codex-rs/arg0/src/lib.rs +++ b/codex-rs/arg0/src/lib.rs @@ -82,10 +82,34 @@ where }) } +const ILLEGAL_ENV_VAR_PREFIX: &str = "CODEX_"; + /// Load env vars from ~/.codex/.env and `$(pwd)/.env`. +/// +/// Security: Do not allow `.env` files to create or modify any variables +/// with names starting with `CODEX_`. fn load_dotenv() { if let Ok(codex_home) = codex_core::config::find_codex_home() { - dotenvy::from_path(codex_home.join(".env")).ok(); + if let Ok(iter) = dotenvy::from_path_iter(codex_home.join(".env")) { + set_filtered(iter); + } + } + + if let Ok(iter) = dotenvy::dotenv_iter() { + set_filtered(iter); + } +} + +/// Helper to set vars from a dotenvy iterator while filtering out `CODEX_` keys. +fn set_filtered(iter: I) +where + I: IntoIterator>, +{ + for (key, value) in iter.into_iter().flatten() { + if !key.to_ascii_uppercase().starts_with(ILLEGAL_ENV_VAR_PREFIX) { + // It is safe to call set_var() because our process is + // single-threaded at this point in its execution. + unsafe { std::env::set_var(&key, &value) }; + } } - dotenvy::dotenv().ok(); }