From 64db2efa3861e8e0bfc55cae7f700a0208b52e49 Mon Sep 17 00:00:00 2001
From: Michael Ingvarsson <michael.ingvarsson@nexergroup.com>
Date: Thu, 16 Jul 2026 11:54:22 +0200
Subject: [PATCH] fix env variables exposure

---
 gitea/config.py              |  6 ------
 gitea/tools/coding_tools.py  | 13 ++++++++++++-
 tests/test_research_tools.py |  6 ++++++
 3 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/gitea/config.py b/gitea/config.py
index 9ad747a..dadb996 100644
--- a/gitea/config.py
+++ b/gitea/config.py
@@ -35,11 +35,5 @@ SEARXNG_URL: str = _agent_settings.searxng_url
 SEARXNG_USERNAME: str = _agent_settings.searxng_username
 SEARXNG_PASSWORD: str = _agent_settings.searxng_password
 
-import os
-os.environ["GITEA_SERVER_URL"] = GITEA_URL
-os.environ["GITEA_SERVER_TOKEN"] = GITEA_TOKEN
-os.environ["SEARXNG_URL"] = SEARXNG_URL
-os.environ["SEARXNG_USERNAME"] = SEARXNG_USERNAME
-os.environ["SEARXNG_PASSWORD"] = SEARXNG_PASSWORD
 
 
diff --git a/gitea/tools/coding_tools.py b/gitea/tools/coding_tools.py
index 4615d46..f0d83f7 100644
--- a/gitea/tools/coding_tools.py
+++ b/gitea/tools/coding_tools.py
@@ -132,6 +132,15 @@ class CodingTools:
 
         return commands
 
+    def _get_subprocess_env(self) -> dict[str, str]:
+        from gitea.config import GITEA_URL, GITEA_TOKEN
+        env = os.environ.copy()
+        if GITEA_URL:
+            env["GITEA_SERVER_URL"] = GITEA_URL
+        if GITEA_TOKEN:
+            env["GITEA_SERVER_TOKEN"] = GITEA_TOKEN
+        return env
+
     def run_verification(self) -> tuple[bool, str]:
         commands = self._parse_verification_commands()
         if not commands:
@@ -143,7 +152,8 @@ class CodingTools:
             try:
                 res = subprocess.run(
                     cmd, shell=True, cwd=self.repo_path,
-                    capture_output=True, text=True, timeout=120
+                    capture_output=True, text=True, timeout=120,
+                    env=self._get_subprocess_env()
                 )
                 if res.returncode != 0:
                     log_output.append(
@@ -213,6 +223,7 @@ class CodingTools:
                 stderr=subprocess.PIPE,
                 text=True,
                 cwd=self.repo_path,
+                env=self._get_subprocess_env(),
             )
             stdout: str
             stderr: str
diff --git a/tests/test_research_tools.py b/tests/test_research_tools.py
index 3e75ae4..b843cd8 100644
--- a/tests/test_research_tools.py
+++ b/tests/test_research_tools.py
@@ -140,6 +140,12 @@ class TestFormatResults:
 
 
 class TestSearchSearxng:
+    @pytest.fixture(autouse=True)
+    def mock_searxng_url(self) -> "Generator[None, None, None]":
+        from typing import Generator
+        with patch("gitea.tools.research_tools._SEARXNG_URL", "http://localhost"):
+            yield
+
     def _make_searxng_response(self, results: list[dict]) -> MagicMock:
         mock_resp = MagicMock()
         mock_resp.json.return_value = {"results": results}