Skip to content

Unset the DYLD_LIBRARY_PATH env var when running Sorbet #820

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
egiurleo wants to merge 1 commit into from
Closed

Unset the DYLD_LIBRARY_PATH env var when running Sorbet #820

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions lib/spoom/context/sorbet.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,10 +9,16 @@ module Sorbet
# Run `bundle exec srb` in this context directory
#: (*String arg, ?sorbet_bin: String?, ?capture_err: bool) -> ExecResult
def srb(*arg, sorbet_bin: nil, capture_err: true)
# If an environment sets the DYLD_LIBRARY_PATH in a way that depends on a version of the C++
# standard library other than the one used by Sorbet, it will cause Sorbet to generate
# corrupted JSON. Unsetting this environment variable forces Sorbet to default to the system
# version of the C++ standard library.
unset_dyld_library_path = "env -u DYLD_LIBRARY_PATH"

@egiurleo egiurleo Nov 20, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Another question -- would it be worth unsetting more than just this env var? I don't want to risk unsetting something that Sorbet actually needs, but at the same time, it seems like this might not be the only env var that could load harmful C++ dependencies by accident?

@paracycle paracycle Nov 20, 2025

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wouldn't do it this way, since it isn't portable. popen3 and friends use Process.spawn in the backend, so they all have the ability to set new env variables for the duration of the spawn, which is what I would use inside exec and bundle_exec.

Moreover, I doubt running sorbet needs any env variables, so I would lean towards using unsetenv_others option in the popen3 implementation to unset all env vars.


res = if sorbet_bin
exec("#{sorbet_bin} #{arg.join(" ")}", capture_err: capture_err)
exec("#{unset_dyld_library_path} #{sorbet_bin} #{arg.join(" ")}", capture_err: capture_err)
else
bundle_exec("srb #{arg.join(" ")}", capture_err: capture_err)
bundle_exec("#{unset_dyld_library_path} srb #{arg.join(" ")}", capture_err: capture_err)
end

case res.exit_code
Expand Down