mirrors/hermes-agent
1
0
Fork 0
mirror of https://github.com/NousResearch/hermes-agent.git synced 2026-06-03 07:21:54 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

fix(webhook): enforce INSECURE_NO_AUTH safety rail on dynamic route reloads

Browse source
This commit is contained in:
Zyrixtrex 2026-05-22 15:52:14 +03:00 • committed by Teknium
parent b4cf5b65dd
commit 61ac118724
2 changed files with 22 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
gateway/platforms/webhook.py
View file

@ -326,6 +326,17 @@ class WebhookAdapter(BasePlatformAdapter):
_INSECURE_NO_AUTH,
)
continue
if (
effective_secret == _INSECURE_NO_AUTH
and not _is_loopback_host(self._host)
):
logger.warning(
"[webhook] Dynamic route '%s' skipped: INSECURE_NO_AUTH "
"is only allowed on loopback hosts. Current host: '%s'.",
k,
self._host,
)
continue
new_dynamic[k] = v
self._dynamic_routes = new_dynamic
self._routes = {**self._dynamic_routes, **self._static_routes}

12
tests/gateway/test_webhook_dynamic_routes.py
View file

@ -138,10 +138,20 @@ class TestDynamicRouteSecretValidation:
(tmp_path / _DYNAMIC_ROUTES_FILENAME).write_text(
json.dumps({"test": {"secret": _INSECURE_NO_AUTH, "prompt": "p"}})
)
adapter = _make_adapter()
adapter = _make_adapter(extra={"host": "127.0.0.1"})
adapter._reload_dynamic_routes()
assert "test" in adapter._routes
def test_insecure_no_auth_rejected_on_non_loopback_bind(self, tmp_path):
# Dynamic INSECURE_NO_AUTH routes are only valid on loopback hosts.
(tmp_path / _DYNAMIC_ROUTES_FILENAME).write_text(
json.dumps({"pub": {"secret": _INSECURE_NO_AUTH, "prompt": "p"}})
)
adapter = _make_adapter(extra={"host": "0.0.0.0"})
adapter._reload_dynamic_routes()
assert "pub" not in adapter._routes
assert "pub" not in adapter._dynamic_routes
def test_warning_logged_on_skip(self, tmp_path, caplog):
import logging
(tmp_path / _DYNAMIC_ROUTES_FILENAME).write_text(