Add support for /extensions config command#17895
Conversation
|
Hi @chrstnb, thank you so much for your contribution to Gemini CLI! We really appreciate the time and effort you've put into this. We're making some updates to our contribution process to improve how we track and review changes. Please take a moment to review our recent discussion post: Improving Our Contribution Process & Introducing New Guidelines. Key Update: Starting January 26, 2026, the Gemini CLI project will require all pull requests to be associated with an existing issue. Any pull requests not linked to an issue by that date will be automatically closed. Thank you for your understanding and for being a part of our community! |
Summary of ChangesHello @chrstnb, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces an interactive Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
|
Size Change: +12.3 kB (+0.05%) Total Size: 23.7 MB
ℹ️ View Unchanged
|
There was a problem hiding this comment.
Code Review
This pull request introduces a new /extensions config command, enabling users to configure extension settings directly from the interactive CLI. However, the implementation has a critical security vulnerability: it relies on underlying functions susceptible to environment variable injection. Malicious extension configurations could inject arbitrary variables into the user's .env file, potentially leading to Remote Code Execution (RCE). It is recommended to add validation for setting names and environment variable names, and to properly escape values when writing to .env files. Additionally, the argument parsing for the --scope flag is incomplete and could lead to incorrect behavior, requiring a more robust and consistent approach.
|
Hi there! Thank you for your contribution to Gemini CLI. We really appreciate the time and effort you've put into this pull request. To keep our backlog manageable and ensure we're focusing on current priorities, we are closing pull requests that haven't seen maintainer activity for 30 days. Currently, the team is prioritizing work associated with 🔒 maintainer only or help wanted issues. If you believe this change is still critical, please feel free to comment with updated details. Otherwise, we encourage contributors to focus on open issues labeled as help wanted. Thank you for your understanding! |
- Fix environment variable injection vulnerability in extensionSettings.ts by validating keys and rejecting values with newlines. - Improve quoting logic for environment variable values. - Fix argument parsing for --scope flag in extensionsCommand.ts to handle both equals and space separators. - Add tests for security fixes in extensionSettings.test.ts.
Summary
Adding the same behavior we have for noninteractive mode to the interactive CLI
Details
Related Issues
Fixes https://github.com/google-gemini/maintainers-gemini-cli/issues/1289
How to Validate
Run the CLI with the following:
Then, open the CLI and invoke
/extensions configwith an extension with config set.Pre-Merge Checklist