fix(patch): cherry-pick 08e8eea to release/v0.29.0-preview.1-pr-18855 to patch version v0.29.0-preview.1 and create version 0.29.0-preview.2#18905
Conversation
Summary of ChangesHello @gemini-cli-robot, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces significant improvements to how the CLI detects and operates in headless environments. By expanding the Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request cherry-picks a fix to correctly handle folder trust in headless mode by refactoring and enhancing the isHeadlessMode utility to be more comprehensive. However, it introduces a critical security bypass in the Folder Trust mechanism. By expanding the definition of 'headless mode' to include cases where a query is provided via command-line arguments or the YOLO flag is used, and subsequently granting automatic trust to a workspace, the security boundary intended to protect users from malicious local configurations is effectively neutralized. This could allow for the execution of untrusted hooks and the loading of unsanitized environment variables from any directory, provided a query or the YOLO flag is present in the command.
| if (isHeadlessMode(headlessOptions)) { | ||
| return { isTrusted: true, source: undefined }; | ||
| } |
There was a problem hiding this comment.
The isWorkspaceTrusted function automatically returns true if isHeadlessMode() is true. Combined with the changes in packages/core/src/utils/headless.ts, this allows a user-controlled flag (like -y or a positional query) to bypass the folder trust security mechanism. This is a critical security bypass because the folder trust feature is intended to be the gatekeeper for dangerous operations like YOLO mode and loading unsanitized environment variables.
| if (isNotTTY || !!options?.prompt || !!options?.query) { | ||
| return true; | ||
| } | ||
|
|
||
| // Fallback: check process.argv for flags that imply headless or auto-approve mode. | ||
| return process.argv.some( | ||
| (arg) => | ||
| arg === '-p' || arg === '--prompt' || arg === '-y' || arg === '--yolo', | ||
| ); |
There was a problem hiding this comment.
The isHeadlessMode function now returns true if a query is provided or if the -y/--yolo flags are present in process.argv. Since isHeadlessMode is used by the folder trust mechanism to automatically grant trust, this allows an attacker to bypass folder trust by simply providing a query or convincing a user to use the YOLO flag. Headless mode detection for security-sensitive decisions should be strictly limited to verified environment indicators (like CI=true) and should not be influenced by user-controlled CLI flags.
| const trustedFolder = | ||
| isWorkspaceTrusted(settings, cwd, undefined, { | ||
| prompt: argv.prompt, | ||
| query: argv.query, | ||
| })?.isTrusted ?? false; |
There was a problem hiding this comment.
Passing argv.query to isWorkspaceTrusted triggers a security bypass. Because isHeadlessMode (called internally by isWorkspaceTrusted) returns true if a query is present, any command that includes a positional argument will cause the current folder to be automatically trusted. This bypasses the trust prompt and allows potentially malicious hooks or configurations in the folder to be executed.
|
Size Change: +382 B (0%) Total Size: 23.9 MB ℹ️ View Unchanged
|
gemini-cli
bot
added
the
status/need-issue
skeshive
merged commit 6a2f2d3
into
release/v0.29.0-preview.1-pr-18855
skeshive
deleted the
hotfix/v0.29.0-preview.1/0.29.0-preview.2/preview/cherry-pick-08e8eea/pr-18855
branch
3 participants
This PR automatically cherry-picks commit 08e8eea to patch version v0.29.0-preview.1 in the preview release to create version 0.29.0-preview.2.