* 🔒 fix: Resolve env vars before body placeholder expansion to prevent secret exfiltration
Body placeholders ({{LIBRECHAT_BODY_*}}) were substituted before
extractEnvVariable ran, allowing user-controlled body fields containing
${SECRET} patterns to be expanded into real environment values in
outbound headers. Reorder so env vars resolve first, preventing
untrusted input from triggering env expansion.
* 🛡️ fix: Block sensitive infrastructure env vars from placeholder resolution
Add isSensitiveEnvVar blocklist to extractEnvVariable so that internal
infrastructure secrets (JWT_SECRET, JWT_REFRESH_SECRET, CREDS_KEY,
CREDS_IV, MEILI_MASTER_KEY, MONGO_URI, REDIS_URI, REDIS_PASSWORD)
can never be resolved via ${VAR} expansion — even if an attacker
manages to inject a placeholder pattern.
Uses exact-match set (not substring patterns) to avoid breaking
legitimate operator config that references OAuth/API secrets in
MCP and custom endpoint configurations.
* 🧹 test: Rename ANOTHER_SECRET test fixture to ANOTHER_VALUE
Avoid using SECRET-containing names for non-sensitive test fixtures
to prevent confusion with the new isSensitiveEnvVar blocklist.
* 🔒 fix: Resolve env vars before all user-controlled substitutions in processSingleValue
Move extractEnvVariable to run on the raw admin-authored template
BEFORE customUserVars, user fields, OIDC tokens, and body placeholders.
Previously env resolution ran after customUserVars, so a user setting
a custom MCP variable to "${SECRET}" could still trigger env expansion.
Now env vars are resolved strictly on operator config, and all
subsequent user-controlled substitutions cannot introduce ${VAR} patterns
that would be expanded.
Gated by !dbSourced so DB-stored servers continue to skip env resolution.
Adds a security-invariant comment documenting the ordering requirement.
* 🧪 test: Comprehensive security regression tests for placeholder injection
- Cover all three body fields (conversationId, parentMessageId, messageId)
- Add user-field injection test (user.name containing ${VAR})
- Add customUserVars injection test (MY_TOKEN = "${VAR}")
- Add processMCPEnv injection tests for body and customUserVars paths
- Remove redundant process.env setup/teardown already handled by beforeEach/afterEach
* 🧹 chore: Add REDIS_PASSWORD to blocklist integration test; document customUserVars gate
* refactor: use new image output format for agents using DALL-E tools
* refactor: Enhance image fetching with proxy support and adjust logging placement in DALL-E 3 integration
* refactor: Enhance StableDiffusionAPI to support agent-specific return values and display message for generated images
* refactor: Add unit test execution for librechat-mcp in backend review workflow
* refactor: Update environment variable extraction logic, export from serpate module to avoid circular refs, and remove deprecated tests
* refactor: Add unit tests for environment variable extraction and enhance StdioOptionsSchema to process env variables
