openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-10-20 17:38:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

Protect the guardian decisions API key from environment forwarding (#50019)

Browse Source 
## What changed

Add `CODEX_GUARDIAN_DECISIONS_API_KEY` to the non-inheritable environment variables and the HTTP header environment denylist. Case-insensitive filtering removes it from child process environments, including explicit shell policy and command overrides, and rejects its use through `http/request` header `value_env_var`.

## Testing

Extend regression coverage for inherited and overridden variables, mixed-case names, and HTTP header rejection before any network request is sent.

GitOrigin-RevId: 1adeef814fdccb2d6c77dd68f7a5dfcec0b41cc6
This commit is contained in:
swastik-oai
2026-10-01 15:57:53 +00:00
committed by copyberry
parent 595534314f
commit 9552906b2b
4 changed files with 17 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/exec-server/src/client/route_aware_http_client.rs
+1
View File
@@ -46,6 +46,7 @@ const HTTP_HEADER_ENV_DENYLIST: &[&str] = &[
OPENAI_IDENTITY_TOKEN_FILE_ENV_VAR,
OPENAI_WORKLOAD_IDENTITY_CONTEXT_ENV_VAR,
"OPENAI_API_KEY",
"CODEX_GUARDIAN_DECISIONS_API_KEY",
"CODEX_API_KEY",
"CODEX_ACCESS_TOKEN",
"CODEX_CONNECTORS_TOKEN",