mirrors/hermes-agent
1
0
Fork 0
mirror of https://github.com/NousResearch/hermes-agent.git synced 2026-07-09 13:21:42 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

fix(security): strip directory components from Teams recording display_name to prevent path traversal

Browse source
This commit is contained in:
memosr 2026-05-18 22:55:37 +03:00 • committed by Teknium
parent 6d30f8c0ab
commit 3590543312
1 changed files with 5 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
plugins/teams_pipeline/pipeline.py
View file

@ -456,7 +456,11 @@ class TeamsMeetingPipeline:
temp_root = self.config.tmp_dir or (get_hermes_home() / "tmp" / "teams_pipeline")
temp_root.mkdir(parents=True, exist_ok=True)
with tempfile.TemporaryDirectory(dir=str(temp_root), prefix="teams-recording-") as tmp_dir:
recording_name = recording.display_name or f"{recording.artifact_id}.mp4"
# display_name comes from Graph API and is ultimately set by
# the meeting organizer — strip any directory components so a
# crafted name like "../../etc/cron.d/evil" can't escape tmp_dir.
raw_name = recording.display_name or f"{recording.artifact_id}.mp4"
recording_name = Path(raw_name).name or f"{recording.artifact_id}.mp4"
recording_path = Path(tmp_dir) / recording_name
await download_recording_artifact(
self.graph_client,