cleveragents/cleveragents-core
4
0
Fork 3
Code Issues 6.0k Pull Requests 115 Actions Packages Projects Releases Wiki Activity

fix(lsp): sanitize environment variables in LSP server process creation #10625

Open
HAL9000 wants to merge 4 commits from fix/v360/lsp-env-var-injection into master
pull from: fix/v360/lsp-env-var-injection
merge into: cleveragents:master
Conversation 15 Commits 4 Files Changed 4
+170 -9

4 Commits

Author SHA1 Message Date
HAL9000 014673bcf9 fix(tests): capture real subprocess.Popen for spec at import time
CI / push-validation (pull_request) Successful in 29s
Details
CI / lint (pull_request) Successful in 42s
Details
CI / build (pull_request) Successful in 46s
Details
CI / helm (pull_request) Successful in 48s
Details
CI / quality (pull_request) Successful in 55s
Details
CI / typecheck (pull_request) Successful in 1m11s
Details
CI / security (pull_request) Successful in 2m19s
Details
CI / unit_tests (pull_request) Successful in 5m57s
Details
CI / docker (pull_request) Successful in 1m41s
Details
CI / integration_tests (pull_request) Successful in 13m11s
Details
CI / coverage (pull_request) Failing after 10m55s
Details
CI / status-check (pull_request) Failing after 3s
Details 
The ltcov test step `step_ltcov_popen_capture_env` patches
`cleveragents.lsp.transport.subprocess.Popen` and invokes
`_make_mock_process()` from inside the `side_effect` callback. Because
Python module objects are singletons, that patch also replaces
`subprocess.Popen` globally. When `make_mock_process` then evaluated
`MagicMock(spec=subprocess.Popen)`, the spec target was itself a
MagicMock, and `mock` raised "Cannot spec a Mock object" — failing the
`ltcov start merges sanitized environment variables` scenario.

Resolve the real `Popen` class once at module import time and use that
captured reference as the spec, so `make_mock_process` works regardless
of whether a patch is active at call time.
 2026-06-04 21:08:04 -04:00
HAL9000 88c7699f13 fix(lsp): allow PYTHONPATH in LSP subprocess environment 
PYTHONPATH is a legitimate configuration variable required by LSP servers
such as Pyright and Pylance to locate project packages. Removing it from
_DISALLOWED_ENV_VARS restores this capability as specified in the issue
security advisory, which explicitly listed PYTHONPATH as an allowed variable.

ISSUES CLOSED: #7184
 2026-06-04 21:08:04 -04:00
HAL9000 a3cd2adf09 fix(lsp): apply ruff format to lsp_transport_coverage_steps.py 2026-06-04 21:08:04 -04:00
HAL9000 9ec0a3d425 fix(lsp): validate environment variables in StdioTransport to prevent code injection 2026-06-04 21:08:04 -04:00