fix(security): validate Hermes endpoint URL and reject allowed_ips in user presets - #6087

Merged

cv merged 10 commits into

mainfrom

fix/ssrf-validation-gaps-6072-6073-v2

Jul 1, 2026

Commits on Jul 1, 2026

fix(security): validate Hermes endpoint URL and reject allowed_ips in user presets

prekshivyas
and
claude
committed
17c3c0e
test(security): remove if statement from hermes SSRF guard test mock

prekshivyas
and
claude
committed
fa8448d
test(security): use real isPrivateHostname in hermes SSRF guard test

prekshivyas
and
claude
committed
1ae6d21
Merge branch 'main' into fix/ssrf-validation-gaps-6072-6073-v2
prekshivyas
authored
b2efd05
fix(security): use Object.hasOwn for allowed_ips check in preset guard

prekshivyas
and
claude
committed
3f85340
test(e2e): add policy-add --from-file allowed_ips rejection E2E (#6073)

prekshivyas
and
claude
committed
5d9cfaa
fix(security): extend Hermes endpoint guards and close applyPresetContent bypass

prekshivyas
and
claude
committed
bc34519
fix(security): pin DNS in Hermes endpoint validation and close policy allowed_ips bypass
prekshivyas
committed
4f20e36
fix(security): exempt host.openshell.internal from allowed_ips guard; fix E2E coverage
prekshivyas
committed
8505c1f
Potential fix for pull request finding 'CodeQL / Unused variable, import, function or class'

prekshivyas
and
github-advanced-security[bot]
authored
378534b