3 commits

Author	SHA1	Message	Date
Teknium	469cd16fe0	fix(security): consolidated security hardening — SSRF, timing attack, tar traversal, credential leakage (#5944) ... Salvaged from PRs #5800 (memosr), #5806 (memosr), #5915 (Ruzzgar), #5928 (Awsh1). Changes: - Use hmac.compare_digest for API key comparison (timing attack prevention) - Apply provider env var blocklist to Docker containers (credential leakage) - Replace tar.extractall() with safe extraction in TerminalBench2 (CVE-2007-4559) - Add SSRF protection via is_safe_url to ALL platform adapters: base.py (cache_image_from_url, cache_audio_from_url), discord, slack, telegram, matrix, mattermost, feishu, wecom (Signal and WhatsApp protected via base.py helpers) - Update tests: mock is_safe_url in Mattermost download tests - Add security tests for tar extraction (traversal, symlinks, safe files)	2026-04-07 17:28:37 -07:00
nguyen binh	c6e2e486bf	fix: add download retry to cache_audio_from_url matching cache_image_from_url (#3401) ... PR #3323 added retry with exponential backoff to cache_image_from_url but missed the sibling function cache_audio_from_url 18 lines below in the same file. A single transient 429/5xx/timeout loses voice messages while image downloads now survive them. Apply the same retry pattern: 3 attempts with 1.5s exponential backoff, immediate raise on non-retryable 4xx.	2026-03-28 17:28:38 -07:00
Teknium	a2847ea7f0	fix(gateway): add media download retry to Mattermost, Slack, and base cache (#3323) ... * fix(gateway): add media download retry to Mattermost, Slack, and base cache Media downloads on Mattermost and Slack fail permanently on transient errors (timeouts, 429 rate limits, 5xx server errors). Telegram and WhatsApp already have retry logic, but these platforms had single-attempt downloads with hardcoded 30s timeouts. Changes: - base.py cache_image_from_url: add retry with exponential backoff (covers Signal and any platform using the shared cache helper) - mattermost.py _send_media_url: retry on 429/5xx/timeout (3 attempts) - slack.py _download_slack_file: retry on timeout/5xx (3 attempts) - slack.py _download_slack_file_bytes: same retry pattern * test: add tests for media download retry --------- Co-authored-by: dieutx <dangtc94@gmail.com>	2026-03-26 19:33:18 -07:00