hermes-agent

mirror of https://github.com/NousResearch/hermes-agent.git synced 2026-05-21 03:39:54 +00:00

Files

T

aaronagent 37bb4f807b fix(dingtalk,api): validate session webhook URL origin, cap webhook cache, reject header injection

dingtalk.py: The session_webhook URL from incoming DingTalk messages is POSTed to
without any origin validation (line 290), enabling SSRF attacks via crafted webhook
URLs (e.g. http://169.254.169.254/ to reach cloud metadata).  Add a regex check
that only accepts the official DingTalk API origin (https://api.dingtalk.com/).
Also cap _session_webhooks dict at 500 entries with FIFO eviction to prevent
unbounded memory growth from long-running gateway instances.

api_server.py: The X-Hermes-Session-Id request header is accepted and echoed back
into response headers (lines 675, 697) without sanitization.  A session ID
containing \r\n enables HTTP response splitting / header injection.  Add a check
that rejects session IDs containing control characters (\r, \n, \x00).

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

2026-04-10 03:05:04 -07:00

builtin_hooks

refactor: replace inline HERMES_HOME re-implementations with get_hermes_home()

2026-04-07 10:40:34 -07:00

platforms

fix(dingtalk,api): validate session webhook URL origin, cap webhook cache, reject header injection

2026-04-10 03:05:04 -07:00

__init__.py

Enhance CLI with multi-platform messaging integration and configuration management

2026-02-02 19:01:51 -08:00

channel_directory.py

feat(gateway): add BlueBubbles iMessage platform adapter (#6437 )