Skip to content

fix(security): restrict public environment export #4166

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kwakayama merged 14 commits into from
Aug 26, 2026
Merged

fix(security): restrict public environment export #4166

Show file tree
Hide file tree
Changes from 9 commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
0c9fa63
fix(security): restrict public environment export
kojiwakayama Aug 25, 2026
a214b76
docs(api-reference): refresh env accessor source line references
kojiwakayama Aug 25, 2026
b673cd9
fix(env): contain Deno tenant environment access
kojiwakayama Aug 26, 2026
d3655f7
Merge branch 'main' into codex/propose-fix-for-env-export-vulnerability
Aug 26, 2026
6164bb9
Merge origin/main into codex/propose-fix-for-env-export-vulnerability
kojiwakayama Aug 26, 2026
f41ffe1
fix(security): close shared host environment escapes
kojiwakayama Aug 26, 2026
8256b79
fix(security): close remaining shared env paths
kojiwakayama Aug 26, 2026
f1a3844
fix(security): preserve supported host module paths
kojiwakayama Aug 26, 2026
46c22a9
fix(security): snapshot project topology once
kojiwakayama Aug 26, 2026
169a7d8
fix(security): close public host env access
kojiwakayama Aug 26, 2026
46d96e0
fix(security): enforce topology across execution paths
kojiwakayama Aug 26, 2026
ff42603
Merge remote-tracking branch 'origin/main' into HEAD
kojiwakayama Aug 26, 2026
eaec412
test(security): clarify shared runtime denial
kojiwakayama Aug 26, 2026
cb566b1
fix(security): align host execution posture
kojiwakayama Aug 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion cli/commands/serve/proxy-extension-composition.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
import { cliLogger } from "veryfront/utils/logger";
import { type ExtensionFactory, ExtensionLoader } from "veryfront/extensions";
import { importFirstPartyExtensionModule } from "veryfront/extensions/first-party-import";
import { getEnv, setEnv } from "veryfront/platform/env";
import { getEnv, setEnv } from "veryfront/platform";
import {
createProxyShutdownAggregateError,
type RegisterProxyShutdownHook,
Expand Down
2 changes: 1 addition & 1 deletion cli/commands/serve/proxy-runtime.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
import { getEnv, setEnv } from "veryfront/platform/env";
import { getEnv, setEnv } from "veryfront/platform";
import { cliLogger } from "veryfront/utils/logger";
import denoConfig from "../../../deno.json" with { type: "json" };
import { ensureCliSchemaValidator } from "../../shared/default-contracts.ts";
Expand Down
4 changes: 2 additions & 2 deletions deno.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,7 @@
"./extensions/observability": "./src/extensions/observability/index.ts",
"./extensions/websocket": "./src/extensions/websocket/index.ts",
"./platform": "./src/platform/index.ts",
"./platform/env": "./src/platform/compat/process/env-public.ts",
"./platform/env": "./src/platform/env.ts",
Comment thread
kojiwakayama marked this conversation as resolved.
Comment thread
kojiwakayama marked this conversation as resolved.
"./platform/path": "./src/platform/compat/path/index.ts",
"./testing": "./src/testing/index.ts",
"./testing/assert": "./src/testing/assert.ts",
Expand Down Expand Up @@ -244,7 +244,7 @@
"veryfront/transforms/mdx-cache": "./src/transforms/mdx/esm-module-loader/cache/index.ts",
"veryfront/observability/otlp-setup": "./src/observability/tracing/otlp-setup.ts",
"veryfront/platform/esbuild-init": "./src/platform/compat/esbuild-init.ts",
"veryfront/platform/env": "./src/platform/compat/process/env-public.ts",
"veryfront/platform/env": "./src/platform/env.ts",
"veryfront/platform/path": "./src/platform/compat/path/index.ts",
"veryfront/platform/http": "./src/platform/compat/http/index.ts",
"veryfront/cli": "./cli/main.ts",
Expand Down
2 changes: 1 addition & 1 deletion docs/api-reference/veryfront/index.client.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ export function GET() {
| `defineConfig` | Define a Veryfront project configuration object. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/config/define-config-core.ts#L4) |
| `defineConfigWithEnv` | Define a Veryfront project configuration from the current environment name. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/config/define-config.ts#L8) |
| `forbidden` | Create a 403 Forbidden response. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/http/responses.ts#L134) |
| `getEnv` | Read an environment variable from the active project scope. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/process/env.ts#L155) |
| `getEnv` | Read an environment variable from the active project scope. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/process/env.ts#L225) |
| `json` | Create a JSON response with the correct content type. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/http/responses.ts#L67) |
| `mergeConfigs` | Merge multiple partial Veryfront configuration objects into one config object. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/config/define-config-core.ts#L17) |
| `notFound` | Render the 404 page from a data loader. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/data/helpers.ts#L63) |
Expand Down
2 changes: 1 addition & 1 deletion docs/api-reference/veryfront/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,7 @@ export function getServerData(ctx: DataContext) {
| `defineConfig` | Define a Veryfront project configuration object. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/config/define-config-core.ts#L4) |
| `defineConfigWithEnv` | Define a Veryfront project configuration from the current environment name. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/config/define-config.ts#L8) |
| `forbidden` | Create a 403 Forbidden response. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/http/responses.ts#L134) |
| `getEnv` | Read an environment variable from the active project scope. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/process/env.ts#L155) |
| `getEnv` | Read an environment variable from the active project scope. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/process/env.ts#L225) |
| `json` | Create a JSON response with the correct content type. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/compat/http/responses.ts#L67) |
| `mergeConfigs` | Merge multiple partial Veryfront configuration objects into one config object. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/config/define-config-core.ts#L17) |
| `notFound` | Render the 404 page from a data loader. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/data/helpers.ts#L63) |
Expand Down
Loading
Loading