External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: Add support for environment protection (scrubbing) (#327)

Browse Source 
* feat: Add support for environment variable protection for sandbox

* chore: Update dangerous env var list

* fix: Split profiles for improved environment protection

* fix: pipx sandbox profile separation

* chore: Show sandbox scrub info on error exit

* fix: Code review fixes

* test: Add e2e for sandbox environment scrubbing
This commit is contained in:
Abhisek Datta
2026-06-11 11:40:33 +05:30
committed by GitHub
parent 7620097613
commit c7244f921a
39 changed files with 1385 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sandbox/profiles/npx.yml
+13
View File
@@ -16,6 +16,19 @@ allow_pty: true
# npx generators and dev servers frequently need to bind to localhost ports
allow_network_bind: true
environment:
# The npm-restrictive base allows no environment variables. npx and pnpx
# execute npm-ecosystem packages and use the npm auth and config
# conventions. Sibling tokens (YARN_NPM_AUTH_*, BUN_AUTH_TOKEN) stay
# scrubbed.
allow:
- NPM_TOKEN
- NPM_AUTH_TOKEN
- NODE_AUTH_TOKEN
- npm_config_*
- NPM_CONFIG_*
- NODE_EXTRA_CA_CERTS
filesystem:
# Add write permissions for common generator outputs
allow_write: