fix(trust): Refuse to load extensions from untrusted workspaces #7342
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Summary of Changes
Hello @richieforeman, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!
This pull request introduces a critical security enhancement by preventing the loading of extensions from untrusted workspaces. The primary goal is to safeguard users from potentially malicious code by ensuring that extensions are only activated in environments explicitly deemed safe. Alongside this security fix, the pull request also includes significant refactoring and tidying of the extension loading and testing infrastructure, improving the overall maintainability and robustness of the codebase.
Highlights
- Enhanced Security: Workspace Trust: The system will now refuse to load extensions from workspaces that are not explicitly marked as trusted, significantly enhancing the security posture of the application.
- Core Logic Update: The logic for loading extensions has been updated to incorporate a trust check, ensuring that only extensions from trusted environments are processed.
- Comprehensive Test Refactoring and New Test Cases: The test suite has been thoroughly updated, including the addition of a specific test case to validate the new untrusted workspace behavior. Furthermore, various test utility functions and path definitions have been refactored for improved clarity and consistency.
Using Gemini Code Assist
The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.
Invoking Gemini
You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.
| Feature | Command | Description |
|---|---|---|
| Code Review | /gemini review |
Performs a code review for the current pull request in its current state. |
| Pull Request Summary | /gemini summary |
Provides a summary of the current pull request in its current state. |
| Comment | @gemini-code-assist | Responds in comments when explicitly tagged, both in issue comments and review comments. |
| Help | /gemini help |
Displays a list of available commands. |
Customization
To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.
Limitations & Feedback
Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.
You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.
Footnotes
-
Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩
There was a problem hiding this comment.
Code Review
This pull request correctly implements the refusal to load extensions from untrusted workspaces. The changes are well-structured, and the refactoring of the test suite improves its clarity and maintainability. However, I've identified a critical logic error in how workspace trust is checked, which could prevent extensions from loading in implicitly trusted workspaces. Additionally, a test helper function has been refactored in a way that could lead to flaky tests. I've provided detailed comments with suggested fixes for both issues.
Code Coverage Summary
CLI Package - Full Text ReportCore Package - Full Text ReportFor detailed HTML reports, please see the 'coverage-reports-22.x-ubuntu-latest' artifact from the main CI run. |
cornmander
reviewed
Aug 28, 2025
shrutip90
reviewed
Aug 28, 2025
| @@ -112,7 +113,10 @@ export function loadExtensions(workspaceDir: string): Extension[] { | |||
| const disabledExtensions = settings.extensions?.disabled ?? []; | |||
| const allExtensions = [...loadUserExtensions()]; | |||
|
|
|||
| if (!settings.experimental?.extensionManagement) { | |||
| if ( | |||
| (isWorkspaceTrusted(settings) ?? true) && | |||
There was a problem hiding this comment.
Everywhere else in code, we use config.isTrustedFolder. Please use that if possible.
There was a problem hiding this comment.
That just checks a boolean. I don't think that does what you're thinking. It's possible to enable folderTrust mode and not be in a restricted/un-trusted folder. It's really important to use this function (or some version of it). This checks the bool + the current dir.
There was a problem hiding this comment.
Oh i see, you're reading isWorkspaceTrusted into that variable within the config (odd. okay).
I have concerns about plumbing config into here since it has so many dependencies.
There was a problem hiding this comment.
We actually wanted to move trustedFolders parsing etc also to core package. Since trust applies to non-CLI packages too. I see one issue with the current implementation for config.isTrustedFolder that it doesnt take into account that the boolean folderTrust flags could change since these settings changes also don't trigger a restart. We can modify config.isTrustedFolder to call isWorkspaceTrusted. I think it would be nice to have one method thats the source of truth that all the checkers rely on.
There was a problem hiding this comment.
Given that config isn't plumbed into here, I'd like to keep this as-is for the moment and have it as something you potentially catch in a followup.
cornmander
approved these changes
Aug 28, 2025
thacio
added a commit
to thacio/auditaria
that referenced
this pull request
Aug 28, 2025
…trusted workspaces (google-gemini#7342)
davideast
pushed a commit
to davideast/gemini-cli
that referenced
this pull request
Sep 2, 2025
LukeSchlangen
pushed a commit
to LukeSchlangen/gemini-cli
that referenced
this pull request
Sep 2, 2025
acoliver
pushed a commit
to acoliver/llxprt-code
that referenced
this pull request
Sep 13, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
TLDR
Refuse to load extensions from untrusted workspaces.
Dive Deeper
I also found these tests a little messy, so I took some liberties to tidy them up. Most of the churn in the tests is due to that. .
Reviewer Test Plan
Testing Matrix
Linked issues / bugs
Closes https://github.com/google-gemini/maintainers-gemini-cli/issues/721