Close seven follow-up bypasses Codex found on the round-37 git / env work:
- GIT_CONFIG_* env override: a leading GIT_CONFIG_COUNT / GIT_CONFIG_GLOBAL /
GIT_CONFIG_SYSTEM (or any GIT_CONFIG*) assignment could drop or shadow the
injected core.hooksPath suppression that _build_safe_env relies on. Treat a
GIT_CONFIG / GIT_CONFIG_* assignment in front of a git child as an unsafe
override (git-config-env-override), and in the argv env-node path require the
suppression key to be present (no override, no ** splat) for a git child.
- GIT_DIR / GIT_WORK_TREE / GIT_INDEX_FILE env vars: an assignment (shell prefix
or argv env mapping) that points git's dir / work tree / index to an escaping
path writes the repo outside the workdir. Block those when the value escapes
(git-write-outside).
- env argv assignments: env NAME=VALUE ... argv[0] carried inline assignments the
scan skipped, so run(['env','PATH=.','evil']) / BASH_ENV hid an unsafe PATH.
Reconstruct the full argv when an env wrapper carries NAME=VALUE tokens and
rerun the blocked-command / unsafe-PATH scan.
- interactive rc shells: bash -ic / sh -i -c source rc files from a user-writable
workdir before running the command. Deny an interactive (-i in a bundled short
flag) shell invocation (shell-interactive-rc:<shell>).
- sed -e / --expression writes: a write / exec command (w / W / s///w / e) can ride
in an -e SCRIPT / -e'SCRIPT' / --expression=SCRIPT operand, not just the bare
positional script. Extract and scan every script source (mutating:sed).
- PATH+= append: the assignment regex did not match NAME+=, so PATH+=:. was parsed
as a local command. Accept a += append assignment (_ASSIGNMENT_RE) and evaluate
PATH+=value as $PATH + value so an unsafe append is still caught while a benign
absolute append (PATH+=:/opt/bin) stays allowed.
- git --exec-path / --config-env / config --file: --exec-path=DIR runs git helpers
from DIR, --config-env=KEY=VAR binds an execution-capable config from an env var,
and git config --file/-f PATH writes a config outside the workdir. Block the exec
forms (git-exec-config) and the escaping --file target (git-write-outside).
Regression coverage: TestRound38Bypasses in tests/test_sandbox_tools.py (per-item
blocked cases plus a benign-allowed set: plain git commit / init, non-write sed
print and substitution, a safe env PATH prefix, a non-interactive shell, and a
benign absolute PATH+= append).
6cdac72b6b