Skip to content

Add security filtering to environment variables endpoint #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jbingham17 merged 1 commit into from
Jan 6, 2026
Merged

Add security filtering to environment variables endpoint #9

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 26 additions & 5 deletions server/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -288,11 +288,32 @@ const server = Bun.serve({
}

if (url.pathname === "/api/environment") {
// Return environment variables for system diagnostics
const envVars = Object.entries(process.env).map(([key, value]) => ({
name: key,
value: value || "",
}));
// Return filtered environment variables for system diagnostics
// Only expose safe, non-sensitive variables

const safeVariables = [
"PATH", "HOME", "USER", "SHELL", "TERM", "LANG", "LC_ALL",
"EDITOR", "VISUAL", "PAGER", "TZ", "PWD", "OLDPWD",
"HOSTNAME", "LOGNAME", "XDG_CONFIG_HOME", "XDG_DATA_HOME",
"NODE_ENV", "RUST_BACKTRACE", "PYTHONDONTWRITEBYTECODE",
];

const sensitivePatterns = [
"KEY", "SECRET", "TOKEN", "PASSWORD", "CREDENTIAL",
"AUTH", "PRIVATE", "API_KEY", "ACCESS_KEY",
];
Comment on lines +301 to +304
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Jan 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Critical: Case-sensitive matching misses lowercase sensitive variables.

The sensitivePatterns array contains uppercase strings, but the matching in isSensitive uses case-sensitive includes(). Variables like api_key, secret, password, or auth_token would bypass detection and have their values exposed.

🔎 Proposed fix to use case-insensitive matching 
-      const isSensitive = (name: string): boolean => {
-        return sensitivePatterns.some(pattern => name.includes(pattern));
-      };
+      const isSensitive = (name: string): boolean => {
+        const upperName = name.toUpperCase();
+        return sensitivePatterns.some(pattern => upperName.includes(pattern));
+      };

Committable suggestion skipped: line range outside the PR's diff.

🤖 Prompt for AI Agents 
In @server/index.ts around lines 301-304, The detection is case-sensitive:
update the sensitivePatterns handling in isSensitive to perform case-insensitive
matching (e.g., normalize candidate names with .toLowerCase() and store patterns
in lowercase or compile case-insensitive regexes) so keys like "api_key",
"secret", "password", and "auth_token" are detected; adjust the
sensitivePatterns array to lowercase tokens
("key","secret","token","password","credential","auth","private","api_key","access_key")
and change the includes() check to compare against the lowercased variable name
within the isSensitive function.


const isSensitive = (name: string): boolean => {
return sensitivePatterns.some(pattern => name.includes(pattern));
};

const envVars = Object.entries(process.env)
.filter(([key]) => safeVariables.includes(key) || key.startsWith("LC_") || key.startsWith("XDG_"))
.map(([key, value]) => ({
name: key,
value: isSensitive(key) ? "[REDACTED]" : (value || ""),
}));
Comment on lines +310 to +315
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Jan 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

# Get the actual code context around lines 310-315
head -320 server/index.ts | tail -30

Repository: coderabbit-demo/btop

Length of output: 1230

🏁 Script executed:

# Check for the isSensitive function definition
rg -n "isSensitive" --type=ts --type=js

Repository: coderabbit-demo/btop

Length of output: 224

🏁 Script executed:

# Search for tests or documentation about environment variable filtering
rg -n -C3 "envVars|REDACTED|environment.*filter|safeVariables" --type=ts --type=js

Repository: coderabbit-demo/btop

Length of output: 2813

🏁 Script executed:

# Look for security guidelines or comments about this behavior
rg -n -C5 "LC_|XDG_|sensitive.*variable|expose.*variable" --type=ts --type=js

Repository: coderabbit-demo/btop

Length of output: 1616

Filter out environment variables with sensitive names, not just redact their values.

The code comment states "Only expose safe, non-sensitive variables," but the current implementation exposes variable names that match sensitive patterns (e.g., LC_API_TOKEN or XDG_SECRET_KEY) when they start with those prefixes, even though their values are redacted. This is an information disclosure issue—revealing that a sensitive variable exists contradicts the stated intent.

Either exclude sensitive variables entirely from the response or adjust the intent comment to clarify that only values are redacted.

🤖 Prompt for AI Agents 
In @server/index.ts around lines 310-315, The envVars construction reveals the
names of sensitive environment variables because it includes keys that start
with "LC_" or "XDG_" even when values are redacted; update the filter so envVars
only includes truly non-sensitive variables by removing the key-starts-with
check and only allowing keys present in safeVariables (or add an explicit
isSensitive(name) check in the .filter to exclude sensitive names), keeping the
.map redaction logic (isSensitive) unchanged; refer to envVars, safeVariables,
and isSensitive to locate and modify the filtering logic accordingly.


return new Response(JSON.stringify({ variables: envVars }), {
headers: {
"Content-Type": "application/json",
Expand Down