-
-
Notifications
You must be signed in to change notification settings - Fork 193
Support persisting custom env vars in session defaults #207
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -20,6 +20,7 @@ export type SessionDefaults = { | |
| preferXcodebuild?: boolean; | ||
| platform?: string; | ||
| bundleId?: string; | ||
| env?: Record<string, string>; | ||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Mutable env leaks through session storeMedium Severity Adding |
||
| }; | ||
|
|
||
| class SessionStore { | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -163,7 +163,14 @@ function createSessionAwareHandler<TParams, TContext>(opts: { | |
| } | ||
|
|
||
| // Start with session defaults merged with explicit args (args override session) | ||
| const merged: Record<string, unknown> = { ...sessionStore.getAll(), ...sanitizedArgs }; | ||
| const sessionDefaults = sessionStore.getAll(); | ||
| const merged: Record<string, unknown> = { ...sessionDefaults, ...sanitizedArgs }; | ||
|
|
||
| // Deep-merge env: combine session-default env vars with user-provided ones | ||
| // (user-provided keys take precedence on conflict) | ||
| if (sessionDefaults.env && typeof sanitizedArgs.env === 'object' && sanitizedArgs.env) { | ||
| merged.env = { ...sessionDefaults.env, ...(sanitizedArgs.env as Record<string, string>) }; | ||
| } | ||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Env validation bypass via deep mergeMedium Severity The
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. |
||
|
|
||
| // Apply exclusive pair pruning: only when caller provided a concrete (non-null/undefined) value | ||
| // for any key in the pair. When activated, drop other keys in the pair coming from session defaults. | ||
|
|
||


Uh oh!
There was an error while loading. Please reload this page.