From d83cd6f7c3ace9b5d5dfa2cee793cc25e28a0f03 Mon Sep 17 00:00:00 2001 From: kshitijk4poor <82637225+kshitijk4poor@users.noreply.github.com> Date: Sat, 11 Jul 2026 12:09:35 +0530 Subject: [PATCH] fix(security): secure Azure catalog probes --- hermes_cli/azure_detect.py | 6 ++++-- tests/hermes_cli/test_azure_detect.py | 4 ++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/hermes_cli/azure_detect.py b/hermes_cli/azure_detect.py index 1420d9334d6..7638ed6aca9 100644 --- a/hermes_cli/azure_detect.py +++ b/hermes_cli/azure_detect.py @@ -46,6 +46,8 @@ from urllib import request as urllib_request from urllib.error import HTTPError, URLError from urllib.parse import urlparse +from hermes_cli.urllib_security import open_credentialed_url + logger = logging.getLogger(__name__) @@ -158,7 +160,7 @@ def _http_get_json(url: str, _apply_auth_headers(req, token, mode) req.add_header("User-Agent", "hermes-agent/azure-detect") try: - with urllib_request.urlopen(req, timeout=timeout) as resp: + with open_credentialed_url(req, timeout=timeout) as resp: body = resp.read() try: return resp.status, json.loads(body.decode("utf-8", errors="replace")) @@ -269,7 +271,7 @@ def _probe_anthropic_messages(base_url: str, req.add_header("content-type", "application/json") req.add_header("User-Agent", "hermes-agent/azure-detect") try: - with urllib_request.urlopen(req, timeout=6.0) as resp: + with open_credentialed_url(req, timeout=6.0) as resp: # Should never 200 — "probe" isn't a real deployment. But # if it does, the endpoint definitely speaks Anthropic. return resp.status < 500 diff --git a/tests/hermes_cli/test_azure_detect.py b/tests/hermes_cli/test_azure_detect.py index 41cd737d780..4628051229c 100644 --- a/tests/hermes_cli/test_azure_detect.py +++ b/tests/hermes_cli/test_azure_detect.py @@ -188,7 +188,7 @@ def test_probe_openai_models_tries_multiple_api_versions(): def test_http_get_json_on_urlerror_returns_zero_none(): """Network failure returns (0, None), never raises.""" import urllib.error - with patch("hermes_cli.azure_detect.urllib_request.urlopen", + with patch("hermes_cli.azure_detect.open_credentialed_url", side_effect=urllib.error.URLError("dns fail")): status, body = azure_detect._http_get_json("https://bad.example/", "k") assert status == 0 @@ -199,7 +199,7 @@ def test_http_get_json_on_http_error_returns_code_none(): """HTTP 4xx/5xx returns (code, None).""" import urllib.error err = urllib.error.HTTPError("https://x/", 403, "Forbidden", {}, None) - with patch("hermes_cli.azure_detect.urllib_request.urlopen", side_effect=err): + with patch("hermes_cli.azure_detect.open_credentialed_url", side_effect=err): status, body = azure_detect._http_get_json("https://x/", "k") assert status == 403 assert body is None