fix: force stdin to Stdio::null for all user code execution (#6575)

Set stdin to Stdio::null for all Commands that execute user code across all supported languages to prevent unwanted input consumption. This affects Python, Deno, Bash, PowerShell, Go, Rust, PHP, Ruby, Java, C#, Ansible, Nu, and Bun executors.

The dedicated worker handler was intentionally left unchanged as it requires stdin for inter-process communication.

Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>

backend/windmill-worker/src/ansible_executor.rs

@@ -1109,6 +1109,7 @@ fi
             .env("BASE_INTERNAL_URL", base_internal_url)
             .env("HOME", HOME_ENV.as_str())
             .args(cmd_args)
+            .stdin(Stdio::null())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped());
 

backend/windmill-worker/src/bash_executor.rs

@@ -212,6 +212,7 @@ exit $exit_status
             .env("BASE_INTERNAL_URL", base_internal_url)
             .env("HOME", HOME_ENV.as_str())
             .args(cmd_args)
+            .stdin(Stdio::null())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped());
         start_child_process(bash_cmd, BIN_BASH.as_str(), false).await?
@@ -807,6 +808,7 @@ $env:PSModulePath = \"{};$PSModulePathBackup\"",
             .env("BASE_INTERNAL_URL", base_internal_url)
             .env("HOME", HOME_ENV.as_str())
             .args(&cmd_args)
+            .stdin(Stdio::null())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped());
 

backend/windmill-worker/src/bun_executor.rs

@@ -1412,6 +1412,7 @@ try {{
                 .envs(reserved_variables)
                 .envs(common_bun_proc_envs)
                 .args(vec!["--preserve-symlinks", &script_path])
+                .stdin(Stdio::null())
                 .stdout(Stdio::piped())
                 .stderr(Stdio::piped());
 
@@ -1442,6 +1443,7 @@ try {{
                 .envs(reserved_variables)
                 .envs(common_bun_proc_envs)
                 .args(args)
+                .stdin(Stdio::null())
                 .stdout(Stdio::piped())
                 .stderr(Stdio::piped());
 

backend/windmill-worker/src/csharp_executor.rs

@@ -599,6 +599,7 @@ pub async fn handle_csharp_job(
             .env("DOTNET_ROOT", DOTNET_ROOT.as_str())
             .env("BASE_INTERNAL_URL", base_internal_url)
             .env("HOME", HOME_ENV.as_str())
+            .stdin(Stdio::null())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped());
         #[cfg(windows)]

backend/windmill-worker/src/deno_executor.rs

@@ -412,6 +412,7 @@ try {{
             .envs(reserved_variables)
             .envs(common_deno_proc_envs)
             .args(args)
+            .stdin(Stdio::null())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped());
         start_child_process(deno_cmd, DENO_PATH.as_str(), false).await?

backend/windmill-worker/src/go_executor.rs

@@ -405,7 +405,7 @@ func Run(req Req) (interface{{}}, error){{
         #[cfg(windows)]
         set_windows_env_vars(&mut run_go);
 
-        run_go.stdout(Stdio::piped()).stderr(Stdio::piped());
+        run_go.stdin(Stdio::null()).stdout(Stdio::piped()).stderr(Stdio::piped());
         start_child_process(run_go, &compiled_executable_name, false).await?
     };
     let handle_result = handle_child(

backend/windmill-worker/src/java_executor.rs

@@ -689,6 +689,7 @@ async fn run<'a>(
             }
         }
         cmd.args(&["-classpath", &classpath, "net.script.App"])
+            .stdin(Stdio::null())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped());
 

backend/windmill-worker/src/nu_executor.rs

@@ -311,6 +311,7 @@ async fn run<'a>(
                 //         .join(",")
                 // ),
             ])
+            .stdin(Stdio::null())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped());
 

backend/windmill-worker/src/php_executor.rs

@@ -321,6 +321,7 @@ try {{
                 .env("COMPOSER_HOME", &*COMPOSER_CACHE_DIR)
                 .env("BASE_INTERNAL_URL", base_internal_url)
                 .args(args)
+                .stdin(Stdio::null())
                 .stdout(Stdio::piped())
                 .stderr(Stdio::piped());
             php_cmd

backend/windmill-worker/src/python_executor.rs

@@ -845,6 +845,7 @@ mount {{
             .env("BASE_INTERNAL_URL", base_internal_url)
             .env("HOME", HOME_ENV.as_str())
             .args(args)
+            .stdin(Stdio::null())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped());
 

backend/windmill-worker/src/ruby_executor.rs

@@ -842,6 +842,7 @@ mount {{
             .envs(envs);
 
         cmd.args(&["main.rb"])
+            .stdin(Stdio::null())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped());
 

backend/windmill-worker/src/rust_executor.rs

@@ -573,6 +573,7 @@ pub async fn handle_rust_job(
             .env("TZ", TZ_ENV.as_str())
             .env("BASE_INTERNAL_URL", base_internal_url)
             .env("HOME", HOME_ENV.as_str())
+            .stdin(Stdio::null())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped());