openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-09-07 15:40:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge 3c80d7da71 into sapling-pr-archive-bolinfest

Browse Source
This commit is contained in:
Michael Bolin
2026-05-05 16:13:24 -07:00
committed by GitHub
parent 4ae685418a 3c80d7da71
commit 5a3457adf7
1 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
codex-rs/exec-server/src/fs_sandbox.rs
View File

@@ -29,6 +29,14 @@ use crate::rpc::internal_error;
use crate::rpc::invalid_request;
const FS_HELPER_ENV_ALLOWLIST: &[&str] = &["PATH", "TMPDIR", "TMP", "TEMP"];
const FS_HELPER_BAZEL_BWRAP_ENV_ALLOWLIST: &[&str] = &[
"CARGO_BIN_EXE_bwrap",
"RUNFILES_DIR",
"RUNFILES_MANIFEST_FILE",
"RUNFILES_MANIFEST_ONLY",
"TEST_SRCDIR",
"TEST_WORKSPACE",
];
#[derive(Clone, Debug)]
pub(crate) struct FileSystemSandboxRunner {
@@ -220,7 +228,10 @@ fn helper_env_from_vars(
}
fn helper_env_key_is_allowed(key: &str) -> bool {
FS_HELPER_ENV_ALLOWLIST.contains(&key) || (cfg!(windows) && key.eq_ignore_ascii_case("PATH"))
FS_HELPER_ENV_ALLOWLIST.contains(&key)
|| (option_env!("BAZEL_PACKAGE").is_some()
&& FS_HELPER_BAZEL_BWRAP_ENV_ALLOWLIST.contains(&key))
|| (cfg!(windows) && key.eq_ignore_ascii_case("PATH"))
}
async fn run_command(