Conversation
… denylist
Two complementary security hardening changes:
1. Dashboard plugin static assets (`/dashboard-plugins/{name}/{path}`)
now require a valid session token. The route is outside `/api/` so
the auth middleware did not cover it — an unauthenticated user could
load arbitrary HTML/JS from plugin directories (stored XSS surface).
Fix: add `_require_token(request)` inline.
2. Extend `build_write_denied_paths()` with four Hermes-internal state
files that an LLM-driven agent must never overwrite:
- `config.yaml` (disables approval system via `approvals.mode: yolo`)
- `auth.json` (OAuth token theft)
- `cron/jobs.json` (malicious cron persistence)
- `shell-hooks-allowlist.json` (hook injection)
Without these entries, a single `write_file` tool call can cascade
from prompt injection to full system compromise (AC-001 attack chain).
Includes 5 new tests in TestHermesInternalStateDenyList (21/21 pass).
Refs: Issue #17873, GHSA-w5p2-4rpw-49c7, GHSA-rf7m-jmc6-g894
alt-glitch
added
type/security
alt-glitch
added
comp/dashboard
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two security hardening improvements for the dashboard and file write safety layer:
Plugin assets authentication — The
/dashboard-plugins/{name}/{path}route now requires a valid session token. Previously, this route was outside the/api/prefix and therefore not covered by the auth middleware. After this change, plugin static assets follow the same authentication rules as all other dashboard endpoints.Write denylist extension —
build_write_denied_paths()now includes four additional Hermes-internal state files:config.yaml,auth.json,cron/jobs.json, andshell-hooks-allowlist.json. These files control agent behavior and credentials, so they should not be writable by the agent's file tools — consistent with the existing protection for.envand SSH keys.Changes
hermes_cli/web_server.py_require_token(request)toserve_plugin_asset()agent/file_safety.pybuild_write_denied_paths()tests/tools/test_file_write_safety.pyTestHermesInternalStateDenyListHow to test
Test results
All 16 existing tests pass (no regressions) + 5 new tests:
test_config_yaml_is_denied✅test_auth_json_is_denied✅test_cron_jobs_json_is_denied✅test_shell_hooks_allowlist_is_denied✅test_env_still_denied✅ (regression guard)Platform
Tested on Linux (Ubuntu 24.04). Changes use
_hermes_home_path()andos.path.realpath()— cross-platform compatible.Related