google-gemini / google-gemini/gemini-cli
scripts/telemetry.js does not validate telemetry.target from settings.json
- Dominant language
- TypeScript
- Stars
- 107k
- Forks
- 14.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 45
Description
### What happened?
`scripts/telemetry.js` validates the telemetry target when it is provided through the `--target` command line argument, but it does not validate the value when it is loaded from `settings.json`.
If `settings.json` contains an invalid value for `telemetry.target`, the script accepts it and continues execution. Later in the script it attempts to construct the telemetry script path using:
```js
const scriptPath = join(projectRoot, 'scripts', targetScripts[target]);
```
If the value of `target` is invalid (for example `"dummy"`), then `targetScripts[target]` becomes `undefined`. This causes the script to fail later during execution with a less clear error that does not explain the root cause.
Example problematic configuration:
```json
{
"telemetry": {
"target": "dummy"
}
}
```
Instead of failing early, the script proceeds and eventually crashes due to the invalid script path.
### What did you expect to happen?
The script should validate `telemetry.target` immediately after loading it from `settings.json`.
If the value is invalid, the script should fail early with a clear error message indicating that the configuration is incorrect and listing the allowed values.
Example expected error message:
```
Error: Invalid telemetry target 'dummy' in settings.json. Allowed targets are: local, gcp, genkit.
```
This early validation would make the configuration problem explicit and prevent a confusing downstream failure.
### Client information
Client Information
Platform: macOS (Apple Silicon)
Node.js: v20.19.0
Gemini CLI: built from latest `main`
### Login information
Using Gemini CLI with a Gemini API key.
Environment variable configuration:
```
GEMINI_API_KEY=***
```
### Anything else we need to know?
The issue occurs because `scripts/telemetry.js` only validates the telemetry target when it is passed through the `--target` CLI argument, but it does not validate the value when it is read from `settings.json`.
Adding a simple validation guard immediately after loading the configuration would prevent this problem.
Example fix:
```js
const allowedTargets = ['local', 'gcp', 'genkit'];
if (!allowedTargets.includes(target)) {
console.error(
`Error: Invalid telemetry target '${target}' in settings.json. Allowed targets are: ${allowedTargets.join(', ')}.`,
);
process.exit(1);
}
```
This ensures invalid configuration values fail early with a clear error message instead of causing an indirect failure later in the script.
Contributor guide
Assessment
This issue has not been assessed yet.