mirrors/hermes-agent
1
0
Fork 0
mirror of https://github.com/NousResearch/hermes-agent.git synced 2026-04-25 00:51:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(security): use hmac.compare_digest for BlueBubbles webhook token to prevent timing attacks

Browse source
This commit is contained in:
memosr 2026-04-13 23:45:38 +03:00
parent a6f07a6c37
commit bf7c7ecf05
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
gateway/platforms/bluebubbles.py
View file

@ -9,6 +9,7 @@ downloading from PR #4588 (YuhangLin).
"""
import asyncio
import hmac
import json
import logging
import os
@ -770,7 +771,7 @@ class BlueBubblesAdapter(BasePlatformAdapter):
or request.headers.get("x-guid")
or request.headers.get("x-bluebubbles-guid")
)
if token != self.password:
if not hmac.compare_digest(token or "", self.password or ""):
return web.json_response({"error": "unauthorized"}, status=401)
try:
raw = await request.read()