From dae1817a17b49536fbf86065e0cce0b55b601dfe Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Yi=C4=9Fit=20ERDO=C4=9EAN?= Date: Tue, 28 Jul 2026 06:58:41 +0300 Subject: [PATCH] fix: block CXXCPP host env override (#112684) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CPP was added to blockedEverywhereKeys in #112560, but its Autoconf twin CXXCPP was not. Autoconf defines the preprocessor selectors as a pair — AC_PROG_CPP sets CPP, AC_PROG_CXXCPP sets CXXCPP — and this list already carries the compiler pair CC/CXX for the same reason. Measured on current main: CC, CXX and CPP all report dangerous, while CXXCPP lands in no category at all (blockedPrefixes is only DYLD_, LD_ and BASH_FUNC_, so no prefix rule covers it either). --- .../Sources/OpenClaw/HostEnvSecurityPolicy.generated.swift | 2 ++ src/infra/host-env-security-policy.json | 1 + src/infra/host-env-security.reported-baseline.json | 3 ++- src/infra/host-env-security.reported-baseline.test.ts | 2 +- src/infra/host-env-security.test.ts | 1 + 5 files changed, 7 insertions(+), 2 deletions(-) diff --git a/apps/macos/Sources/OpenClaw/HostEnvSecurityPolicy.generated.swift b/apps/macos/Sources/OpenClaw/HostEnvSecurityPolicy.generated.swift index 4ef385d708c4..f712085c2c55 100644 --- a/apps/macos/Sources/OpenClaw/HostEnvSecurityPolicy.generated.swift +++ b/apps/macos/Sources/OpenClaw/HostEnvSecurityPolicy.generated.swift @@ -62,6 +62,7 @@ enum HostEnvSecurityPolicy { "CPP", "CURL_HOME", "CXX", + "CXXCPP", "C_INCLUDE_PATH", "DATABASE_URL", "DENO_DIR", @@ -244,6 +245,7 @@ enum HostEnvSecurityPolicy { "CORECLR_PROFILER", "CPP", "CXX", + "CXXCPP", "DOTNET_ADDITIONAL_DEPS", "DOTNET_STARTUP_HOOKS", "ELIXIR_ERL_OPTIONS", diff --git a/src/infra/host-env-security-policy.json b/src/infra/host-env-security-policy.json index 094a47ab6333..5d481c745f44 100644 --- a/src/infra/host-env-security-policy.json +++ b/src/infra/host-env-security-policy.json @@ -37,6 +37,7 @@ "CC", "CPP", "CXX", + "CXXCPP", "CARGO_BUILD_RUSTC", "CARGO_BUILD_RUSTC_WRAPPER", "CARGO_BUILD_RUSTC_WORKSPACE_WRAPPER", diff --git a/src/infra/host-env-security.reported-baseline.json b/src/infra/host-env-security.reported-baseline.json index f92d7a43f603..b29894b0e3c2 100644 --- a/src/infra/host-env-security.reported-baseline.json +++ b/src/infra/host-env-security.reported-baseline.json @@ -23,6 +23,7 @@ "CORECLR_PROFILER", "CPP", "CXX", + "CXXCPP", "DOTNET_ADDITIONAL_DEPS", "DOTNET_STARTUP_HOOKS", "ELIXIR_ERL_OPTIONS", @@ -270,5 +271,5 @@ "YARN_RC_FILENAME", "ZDOTDIR" ], - "expectedTotalReportedEntries": 265 + "expectedTotalReportedEntries": 266 } diff --git a/src/infra/host-env-security.reported-baseline.test.ts b/src/infra/host-env-security.reported-baseline.test.ts index c66fe0f75111..6a29dc8902a1 100644 --- a/src/infra/host-env-security.reported-baseline.test.ts +++ b/src/infra/host-env-security.reported-baseline.test.ts @@ -98,7 +98,7 @@ describe("host env reported baseline coverage", () => { baseline.reportedDangerousEverywhereKeys.length + baseline.reportedDangerousOverrideOnlyKeys.length, ).toBe(baseline.expectedTotalReportedEntries); - expect(baseline.expectedTotalReportedEntries).toBe(265); + expect(baseline.expectedTotalReportedEntries).toBe(266); expect(sortUniqueUpper(baseline.reportedDangerousEverywhereKeys)).toEqual( baseline.reportedDangerousEverywhereKeys, ); diff --git a/src/infra/host-env-security.test.ts b/src/infra/host-env-security.test.ts index 5c5cc96287e8..b67a9d89efa3 100644 --- a/src/infra/host-env-security.test.ts +++ b/src/infra/host-env-security.test.ts @@ -182,6 +182,7 @@ describe("isDangerousHostEnvVarName", () => { expect(isDangerousHostEnvVarName("CC")).toBe(true); expect(isDangerousHostEnvVarName("cpp")).toBe(true); expect(isDangerousHostEnvVarName("cxx")).toBe(true); + expect(isDangerousHostEnvVarName("cxxcpp")).toBe(true); expect(isDangerousHostEnvVarName("CARGO_BUILD_RUSTC")).toBe(true); expect(isDangerousHostEnvVarName("cargo_build_rustc")).toBe(true); expect(isDangerousHostEnvVarName("CARGO_BUILD_RUSTC_WRAPPER")).toBe(true);