mirrors/hermes-agent
1
0
Fork 0
mirror of https://github.com/NousResearch/hermes-agent.git synced 2026-07-20 15:24:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

fix(image-gen): guard local provider inputs against credential reads

Browse source
This commit is contained in:
dsad 2026-07-03 14:57:05 +03:00 • committed by kshitij
parent 203b5d4cea
commit 587be5b5b4
4 changed files with 44 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
plugins/image_gen/openai/__init__.py
View file

@ -147,6 +147,16 @@ def _load_image_bytes(ref: str) -> Tuple[bytes, str]:
ext = header.split("image/", 1)[1].split(";", 1)[0] or "png"
return base64.b64decode(b64), f"image.{ext}"
# Local file path.
try:
from agent.file_safety import get_read_block_error
blocked = get_read_block_error(ref)
if blocked:
raise ValueError(blocked)
except ValueError:
raise
except Exception as exc: # noqa: BLE001 - preserve existing local-file behavior
logger.debug("OpenAI image input read guard unavailable: %s", exc)
with open(ref, "rb") as fh:
data = fh.read()
name = os.path.basename(ref) or "image.png"

10
plugins/image_gen/openrouter/__init__.py
View file

@ -97,6 +97,16 @@ def _to_image_url_part(ref: str) -> Optional[str]:
if ref.startswith(("http://", "https://", "data:")):
return ref
path = Path(ref)
try:
from agent.file_safety import get_read_block_error
blocked = get_read_block_error(ref)
if blocked:
raise ValueError(blocked)
except ValueError:
raise
except Exception as exc: # noqa: BLE001 - keep local image refs best-effort
logger.debug("OpenRouter image input read guard unavailable: %s", exc)
try:
raw = path.read_bytes()
except OSError as exc: