Check if command sets forbidden environment variables. Returns (True, env_var_name, base_error) if forbidden env var found, None otherwise.
(command: str)
| 143 | |
| 144 | |
| 145 | def check_forbidden_env_vars(command: str) -> tuple[bool, str, str] | None: |
| 146 | """ |
| 147 | Check if command sets forbidden environment variables. |
| 148 | |
| 149 | Returns (True, env_var_name, base_error) if forbidden env var found, None otherwise. |
| 150 | """ |
| 151 | for env_var in FORBIDDEN_ENV_VARS: |
| 152 | # Match VAR=value or VAR=value command |
| 153 | pattern = rf"\b{re.escape(env_var)}=" |
| 154 | if re.search(pattern, command): |
| 155 | base_error = f"Setting {env_var} is forbidden (disables critical performance optimization)" |
| 156 | return (True, env_var, base_error) |
| 157 | return None |
| 158 | |
| 159 | |
| 160 | def parse_env_vars_from_command(command: str) -> dict[str, str]: |