don't hand the keys to the kingdom to plugin scripts

components/script-execution/src/main/kotlin/vdi/components/script/environment.kt

@@ -0,0 +1,43 @@
+package vdi.components.script
+
+/**
+ * Array of environment variables that are 'safe' to pass through to the plugin
+ * scripts.
+ *
+ * Any environment variable that does not appear in this array will not be
+ * passed through from the server environment to the plugin environment.
+ */
+private val SafeKeys = arrayOf(
+  "_",
+  "GUS_HOME",
+  "HOSTNAME",
+  "JAVA_HOME",
+  "LANG",
+  "LD_LIBRARY_PATH",
+  "ORACLE_HOME",
+  "PATH",
+  "SITE_BUILD",
+  "TEMPLATE_DB_NAME",
+  "TEMPLATE_DB_USER",
+  "TZ",
+)
+
+private val BaseMap: Map<String, String> = HashMap<String, String>(SafeKeys.size)
+  .apply { SafeKeys.forEach { key -> System.getenv(key)?.also { put(key, it) } } }
+
+/**
+ * Executes the given function with a mutable copy of the available, safe
+ * environment variables
+ *
+ * @param T Type of the value returned by the given function.
+ *
+ * @param fn Function to execute with a safe, mutable environment map.
+ *
+ * @return The value returned by fn.
+ */
+inline fun <T> withScriptEnvironment(fn: (env: MutableMap<String, String>) -> T) = fn(cloneEnvironment())
+
+/**
+ * Creates a mutable copy of the safe environment variables.
+ */
+fun cloneEnvironment(): MutableMap<String, String> = HashMap<String, String>(24).apply { putAll(BaseMap) }

service/src/main/kotlin/vdi/service/HandlerBase.kt

@@ -6,6 +6,7 @@ import org.veupathdb.vdi.lib.common.field.DatasetID
 import java.nio.file.Path
 import vdi.components.metrics.ScriptMetrics
 import vdi.components.script.ScriptExecutor
+import vdi.components.script.cloneEnvironment
 import vdi.consts.ScriptEnvKey
 
 sealed class HandlerBase<T>(
@@ -37,10 +38,7 @@ sealed class HandlerBase<T>(
   abstract suspend fun run(): T
 
   protected fun buildScriptEnv(): Environment {
-    val out = System.getenv()
-      .asSequence()
-      .filter { (k, _) -> !k.startsWith(EnvKey.AppDB.CommonPrefix) }
-      .associateByTo(HashMap(), Map.Entry<String, String>::key, Map.Entry<String, String>::value)
+    val out = cloneEnvironment()
 
     if (customPath.isNotBlank())
       out["PATH"] = out["PATH"] + ':' + customPath

settings.gradle.kts

@@ -8,4 +8,4 @@ include(
   ":components:script-execution",
 )
 
-include(":service")
+include(":service")