mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
Abhisek DattaandGitHub
c7244f921a
* feat: Add support for environment variable protection for sandbox * chore: Update dangerous env var list * fix: Split profiles for improved environment protection * fix: pipx sandbox profile separation * chore: Show sandbox scrub info on error exit * fix: Code review fixes * test: Add e2e for sandbox environment scrubbing
41 lines
1.0 KiB
YAML
41 lines
1.0 KiB
YAML
name: npx
|
|
description: Profile for npx/pnpx generators with write access to current directory
|
|
inherits: npm-restrictive
|
|
|
|
package_managers:
|
|
- npx
|
|
- pnpx
|
|
|
|
# npx and pnpx require PTY access to work, especially for commands like:
|
|
# npx create-next-app@latest
|
|
#
|
|
# Explicitly setting this so that it is enabled even if we decide to turn this off
|
|
# in parent profiles in the future.
|
|
allow_pty: true
|
|
|
|
# npx generators and dev servers frequently need to bind to localhost ports
|
|
allow_network_bind: true
|
|
|
|
environment:
|
|
# The npm-restrictive base allows no environment variables. npx and pnpx
|
|
# execute npm-ecosystem packages and use the npm auth and config
|
|
# conventions. Sibling tokens (YARN_NPM_AUTH_*, BUN_AUTH_TOKEN) stay
|
|
# scrubbed.
|
|
allow:
|
|
- NPM_TOKEN
|
|
- NPM_AUTH_TOKEN
|
|
- NODE_AUTH_TOKEN
|
|
- npm_config_*
|
|
- NPM_CONFIG_*
|
|
- NODE_EXTRA_CA_CERTS
|
|
|
|
filesystem:
|
|
# Add write permissions for common generator outputs
|
|
allow_write:
|
|
- ${CWD}/**
|
|
|
|
# Additional deny rules for extra security
|
|
deny_write:
|
|
- ${CWD}/.env
|
|
- ${CWD}/.env.*
|