mirrors/hermes-agent
1
0
Fork 0
mirror of https://github.com/NousResearch/hermes-agent.git synced 2026-07-31 19:16:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

fix(egress): silence CodeQL clear-text-logging on bws warning strings

Browse source 
The bws helper's warnings list contains non-secret status messages
('rate limited', 'project not found', etc.), but CodeQL's taint
analyzer can't distinguish those from the secrets dict returned by
the same call.  Log the count instead of the strings — the warnings
are still observable via 'hermes secrets bitwarden status'.
This commit is contained in:
teknium1 2026-05-23 02:26:14 -07:00
parent 128a6837b7
commit 4833acf046
No known key found for this signature in database
1 changed files with 17 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

21
agent/proxy_sources/iron_proxy.py
View file

@ -1382,13 +1382,26 @@ def _build_proxy_subprocess_env(
for n in needed:
if n in secrets:
env[n] = secrets[n]
for w in warnings:
logger.warning("Bitwarden refresh: %s", w)
# bws warnings are non-secret status messages (e.g. "no
# project found", "rate limited"), but the taint analyzer
# can't tell that — log the count and let the operator
# rerun under verbose if they need detail.
if warnings:
logger.warning(
"Bitwarden refresh produced %d warning(s); "
"run `hermes secrets bitwarden status` for detail.",
len(warnings),
)
else:
# NOTE: deliberately do not interpolate access_token_name
# in the log message — CodeQL's taint analyzer treats
# bitwarden_config values as secret-tainted (it can't
# distinguish the env-var NAME from the env-var VALUE).
# The name is non-secret but logging it just trips the
# check for no real benefit.
logger.warning(
"credential_source=bitwarden but access_token_env=%s or "
"credential_source=bitwarden but access-token env or "
"project_id is empty — proxy will fall back to parent env",
access_token_name,
)
except (ImportError, RuntimeError) as exc:
logger.warning(