fix(patch): cherry-pick 08e8eea to release/v0.28.2-pr-18855 to patch version v0.28.2 and create version 0.28.3#18904
Conversation
Summary of ChangesHello @gemini-cli-robot, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request refines the detection and handling of headless environments across the CLI and core libraries. It ensures that operations requiring user interaction, such as folder trust prompts, are automatically approved when running in a headless context, improving automation and CI/CD compatibility. The changes also standardize how headless mode is determined by incorporating command-line arguments and query parameters into the detection logic. Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request intends to improve headless mode detection and ensure folder trust checks are bypassed in non-interactive scenarios by considering query arguments and process.argv. However, it introduces a critical security vulnerability: broadening the definition of headless mode to include flags like --yolo and positional queries conflates it with folder trust, allowing an attacker to bypass the Folder Trust mechanism. This could lead to Remote Code Execution (RCE) by loading malicious .gemini/settings.json files if a user is tricked into running a command in a malicious directory. Furthermore, the process.argv check might not correctly handle arguments using an equals sign.
| if (isNotTTY || !!options?.prompt || !!options?.query) { | ||
| return true; | ||
| } | ||
|
|
||
| // Fallback: check process.argv for flags that imply headless or auto-approve mode. | ||
| return process.argv.some( | ||
| (arg) => | ||
| arg === '-p' || arg === '--prompt' || arg === '-y' || arg === '--yolo', | ||
| ); |
There was a problem hiding this comment.
This section introduces a critical security vulnerability. Expanding isHeadlessMode to return true for -y/--yolo flags or a query directly impacts isWorkspaceTrusted, allowing an attacker to bypass the Folder Trust security mechanism. This could lead to Remote Code Execution (RCE) if a user is tricked into running gemini with these flags or a query in a malicious directory, enabling the loading of untrusted local configurations (.gemini/settings.json) and environment variables (.env). Furthermore, the current argument parsing for flags like --prompt and --yolo is not robust; it fails for arguments using an equals sign (e.g., --prompt=my-prompt), which could have unintended security consequences or functional issues in headless mode detection.
| if (isHeadlessMode(headlessOptions)) { | ||
| return true; | ||
| } |
There was a problem hiding this comment.
Automatically granting folder trust based on isHeadlessMode is insecure, especially with the changes in this PR that allow isHeadlessMode to be triggered by common CLI flags like --yolo or even a simple positional query.
This creates a direct security bypass where untrusted workspaces are treated as trusted. When a workspace is trusted, the CLI loads local configuration files that can override sensitive settings. An attacker can place a malicious .gemini/settings.json in a folder and achieve Remote Code Execution (RCE) if a user runs the CLI in that folder with any argument that triggers the broadened isHeadlessMode check.
| if (isHeadlessMode(headlessOptions)) { | ||
| return { isTrusted: true, source: undefined }; | ||
| } |
There was a problem hiding this comment.
This check bypasses the folder trust mechanism if the environment is considered 'headless'. As noted in the review for headless.ts, the definition of headless mode has been dangerously expanded to include common interactive flags. This allows for a complete bypass of the security boundary intended to protect users from malicious local configurations.
|
Size Change: +382 B (0%) Total Size: 23.7 MB ℹ️ View Unchanged
|
gemini-cli
bot
added
the
status/need-issue
|
Hi there! Thank you for your contribution to Gemini CLI. We really appreciate the time and effort you've put into this pull request. To keep our backlog manageable and ensure we're focusing on current priorities, we are closing pull requests that haven't seen maintainer activity for 30 days. Currently, the team is prioritizing work associated with 🔒 maintainer only or help wanted issues. If you believe this change is still critical, please feel free to comment with updated details. Otherwise, we encourage contributors to focus on open issues labeled as help wanted. Thank you for your understanding! |
2 participants
This PR automatically cherry-picks commit 08e8eea to patch version v0.28.2 in the stable release to create version 0.28.3.