security: implement hard blocklist for workspace environment variables to prevent RCE

packages/cli/src/config/settings.test.ts

@@ -2165,6 +2165,139 @@ describe('Settings Loading and Merging', () => {
         process.argv = originalArgv;
       }
     });
+
+    it('always blocks restricted variables from workspace .env files', () => {
+      const workspaceEnvPath = path.resolve(
+        path.join(MOCK_WORKSPACE_DIR, '.env'),
+      );
+
+      vi.spyOn(trustedFolders, 'isWorkspaceTrusted').mockReturnValue({
+        isTrusted: true, // Even if trusted!
+        source: 'file',
+      });
+
+      (mockFsExistsSync as Mock).mockImplementation(
+        (p: fs.PathLike) => path.resolve(p.toString()) === workspaceEnvPath,
+      );
+
+      (fs.readFileSync as Mock).mockImplementation(
+        (p: fs.PathOrFileDescriptor) => {
+          if (path.resolve(p.toString()) === workspaceEnvPath) {
+            return 'GEMINI_CLI_IDE_SERVER_STDIO_COMMAND=malicious\nNODE_OPTIONS=--inspect\nSAFE_VAR=ok';
+          }
+          return '';
+        },
+      );
+
+      delete process.env['GEMINI_CLI_IDE_SERVER_STDIO_COMMAND'];
+      delete process.env['NODE_OPTIONS'];
+      delete process.env['SAFE_VAR'];
+
+      loadEnvironment(createTestMergedSettings(), MOCK_WORKSPACE_DIR);
+
+      expect(
+        process.env['GEMINI_CLI_IDE_SERVER_STDIO_COMMAND'],
+      ).toBeUndefined();
+      expect(process.env['NODE_OPTIONS']).toBeUndefined();
+      expect(process.env['SAFE_VAR']).toBe('ok');
+      expect(mockCoreEvents.emitFeedback).toHaveBeenCalledWith(
+        'warning',
+        expect.stringContaining('Security Warning'),
+      );
+    });
+
+    it('blocks restricted variables case-insensitively', () => {
+      const workspaceEnvPath = path.resolve(
+        path.join(MOCK_WORKSPACE_DIR, '.env'),
+      );
+
+      (mockFsExistsSync as Mock).mockImplementation(
+        (p: fs.PathLike) => path.resolve(p.toString()) === workspaceEnvPath,
+      );
+
+      (fs.readFileSync as Mock).mockImplementation(
+        (p: fs.PathOrFileDescriptor) => {
+          if (path.resolve(p.toString()) === workspaceEnvPath) {
+            return 'node_options=--inspect\nShell=/bin/evil\npath=/tmp/bin';
+          }
+          return '';
+        },
+      );
+
+      delete process.env['node_options'];
+      delete process.env['Shell'];
+      delete process.env['path'];
+
+      loadEnvironment(createTestMergedSettings(), MOCK_WORKSPACE_DIR);
+
+      expect(process.env['node_options']).toBeUndefined();
+      expect(process.env['Shell']).toBeUndefined();
+      expect(process.env['path']).toBeUndefined();
+      expect(mockCoreEvents.emitFeedback).toHaveBeenCalledWith(
+        'warning',
+        expect.stringContaining('Security Warning'),
+      );
+    });
+
+    it('identifies project .env files robustly even if path contains .gemini', () => {
+      const trickyWorkspaceDir = path.resolve(
+        '/mock/home/user/my.gemini.tools',
+      );
+      const trickyEnvPath = path.join(trickyWorkspaceDir, '.env');
+
+      (mockFsExistsSync as Mock).mockImplementation(
+        (p: fs.PathLike) => path.resolve(p.toString()) === trickyEnvPath,
+      );
+
+      (fs.readFileSync as Mock).mockImplementation(
+        (p: fs.PathOrFileDescriptor) => {
+          if (path.resolve(p.toString()) === trickyEnvPath) {
+            return 'NODE_OPTIONS=--inspect';
+          }
+          return '';
+        },
+      );
+
+      delete process.env['NODE_OPTIONS'];
+
+      loadEnvironment(createTestMergedSettings(), trickyWorkspaceDir);
+
+      // It SHOULD be blocked because it's not the global .gemini/.env
+      expect(process.env['NODE_OPTIONS']).toBeUndefined();
+      expect(mockCoreEvents.emitFeedback).toHaveBeenCalledWith(
+        'warning',
+        expect.stringContaining('Security Warning'),
+      );
+    });
+
+    it('blocks newly added dangerous variables (PATH, LD_LIBRARY_PATH, etc.)', () => {
+      const workspaceEnvPath = path.resolve(
+        path.join(MOCK_WORKSPACE_DIR, '.env'),
+      );
+
+      (mockFsExistsSync as Mock).mockImplementation(
+        (p: fs.PathLike) => path.resolve(p.toString()) === workspaceEnvPath,
+      );
+
+      (fs.readFileSync as Mock).mockImplementation(
+        (p: fs.PathOrFileDescriptor) => {
+          if (path.resolve(p.toString()) === workspaceEnvPath) {
+            return 'PATH=/tmp/evil\nLD_LIBRARY_PATH=/tmp/evil\nDYLD_LIBRARY_PATH=/tmp/evil';
+          }
+          return '';
+        },
+      );
+
+      delete process.env['PATH'];
+      delete process.env['LD_LIBRARY_PATH'];
+      delete process.env['DYLD_LIBRARY_PATH'];
+
+      loadEnvironment(createTestMergedSettings(), MOCK_WORKSPACE_DIR);
+
+      expect(process.env['PATH']).toBeUndefined();
+      expect(process.env['LD_LIBRARY_PATH']).toBeUndefined();
+      expect(process.env['DYLD_LIBRARY_PATH']).toBeUndefined();
+    });
   });
 
   describe('migrateDeprecatedSettings', () => {