fix(security): block HOME and ZDOTDIR env override injection

2026-05-09 10:17:39 +00:00 · 2026-02-22 09:41:55 +01:00
parent ccc00d874c
commit c2c7114ed3
6 changed files with 55 additions and 3 deletions
--- a/src/infra/host-env-security-policy.json
+++ b/src/infra/host-env-security-policy.json
@@ -15,5 +15,6 @@
    "IFS",
    "SSLKEYLOGFILE"
  ],
+  "blockedOverrideKeys": ["HOME", "ZDOTDIR"],
  "blockedPrefixes": ["DYLD_", "LD_", "BASH_FUNC_"]
 }