Skip to content

fix(gateway): block Hermes home media attachments #35939

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
zapabob wants to merge 2 commits into from
Closed

fix(gateway): block Hermes home media attachments #35939

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6fa6d45
fix(gateway): block Hermes home media attachments
zapabob May 31, 2026
7ba4e04
Merge remote-tracking branch 'upstream/main' into codex/gateway-media…
zapabob Jun 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 4 additions & 6 deletions gateway/platforms/base.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -956,13 +956,11 @@ def _media_delivery_denied_paths() -> List[Path]:
for sub in _MEDIA_DELIVERY_DENIED_HOME_SUBPATHS:
denied.append(home / sub)
# The active Hermes profile and shared Hermes root both contain control
# files and credentials. Only cache subdirectories under them are
# explicitly allowlisted above.
# files, OAuth refresh tokens, MCP tokens, session databases, and
# credentials. Only cache/operator-allowlisted subdirectories under them
# may be delivered.
for hermes_root in (_HERMES_HOME, _HERMES_ROOT):
denied.append(hermes_root / ".env")
denied.append(hermes_root / "auth.json")
denied.append(hermes_root / "credentials")
denied.append(hermes_root / "config.yaml")
denied.append(hermes_root)
return denied

@teknium1 teknium1 Jul 13, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This whole-root deny reverses current main's intentional targeted policy. Main explicitly preserves fresh non-credential files under Hermes home (tests/gateway/test_platform_base.py:1165-1184); please re-scope to a concrete sensitive path instead.


Expand Down
53 changes: 53 additions & 0 deletions tests/gateway/test_platform_base.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -737,6 +737,7 @@ def test_recency_trust_denies_system_paths_even_when_fresh(self, tmp_path, monke
secret = ssh_dir / "id_rsa.txt"
secret.write_bytes(b"-----BEGIN ...") # mtime = now
monkeypatch.setenv("HOME", str(fake_home))
monkeypatch.setenv("USERPROFILE", str(fake_home))

assert BasePlatformAdapter.validate_media_delivery_path(str(secret)) is None

Expand Down Expand Up @@ -831,6 +832,7 @@ def test_denylist_still_blocks_credentials(self, tmp_path, monkeypatch):
secret = ssh_dir / "id_rsa"
secret.write_bytes(b"-----BEGIN ...")
monkeypatch.setenv("HOME", str(fake_home))
monkeypatch.setenv("USERPROFILE", str(fake_home))

assert BasePlatformAdapter.validate_media_delivery_path(str(secret)) is None

Expand Down Expand Up @@ -866,6 +868,7 @@ def test_denylist_blocks_hermes_credentials(self, tmp_path, monkeypatch):
env_file = hermes_dir / ".env"
env_file.write_text("OPENAI_API_KEY=sk-...")
monkeypatch.setenv("HOME", str(fake_home))
monkeypatch.setenv("USERPROFILE", str(fake_home))
monkeypatch.setattr(
"gateway.platforms.base._HERMES_HOME",
hermes_dir,
Expand All @@ -883,6 +886,7 @@ def test_denylist_blocks_hermes_config_in_active_profile(self, tmp_path, monkeyp
config_file = hermes_dir / "config.yaml"
config_file.write_text("model:\n provider: openai\n")
monkeypatch.setenv("HOME", str(fake_home))
monkeypatch.setenv("USERPROFILE", str(fake_home))
monkeypatch.setattr(
"gateway.platforms.base._HERMES_HOME",
hermes_dir,
Expand All @@ -901,6 +905,7 @@ def test_denylist_blocks_shared_hermes_root_config_for_profiles(self, tmp_path,
config_file = hermes_root / "config.yaml"
config_file.write_text("profiles:\n active: work\n")
monkeypatch.setenv("HOME", str(fake_home))
monkeypatch.setenv("USERPROFILE", str(fake_home))
monkeypatch.setattr(
"gateway.platforms.base._HERMES_HOME",
profile_home,
Expand All @@ -912,6 +917,54 @@ def test_denylist_blocks_shared_hermes_root_config_for_profiles(self, tmp_path,

assert BasePlatformAdapter.validate_media_delivery_path(str(config_file)) is None

def test_denylist_blocks_non_cache_hermes_home_files(self, tmp_path, monkeypatch):
"""Non-cache files under the active Hermes home are never attachments."""
self._patch_roots(monkeypatch)

hermes_dir = tmp_path / ".hermes"
for relative in (
".anthropic_oauth.json",
"auth/google_oauth.json",
"mcp-tokens/server.json",
"sessions.json",
):
secret = hermes_dir / relative
secret.parent.mkdir(parents=True, exist_ok=True)
secret.write_text("secret")
monkeypatch.setattr("gateway.platforms.base._HERMES_HOME", hermes_dir)
monkeypatch.setattr("gateway.platforms.base._HERMES_ROOT", hermes_dir)

assert BasePlatformAdapter.validate_media_delivery_path(str(secret)) is None

def test_cache_allowlist_beats_hermes_home_denylist(self, tmp_path, monkeypatch):
"""Generated cache artifacts still deliver from under HERMES_HOME."""
hermes_dir = tmp_path / ".hermes"
cache_root = hermes_dir / "cache" / "documents"
self._patch_roots(monkeypatch, cache_root)

report = cache_root / "report.pdf"
report.parent.mkdir(parents=True)
report.write_bytes(b"%PDF-1.4")
monkeypatch.setattr("gateway.platforms.base._HERMES_HOME", hermes_dir)
monkeypatch.setattr("gateway.platforms.base._HERMES_ROOT", hermes_dir)

assert BasePlatformAdapter.validate_media_delivery_path(str(report)) == str(report.resolve())

def test_operator_allowlist_beats_hermes_home_denylist(self, tmp_path, monkeypatch):
"""Explicit operator media roots under HERMES_HOME remain deliverable."""
self._patch_roots(monkeypatch)

hermes_dir = tmp_path / ".hermes"
export_root = hermes_dir / "exports"
report = export_root / "report.pdf"
report.parent.mkdir(parents=True)
report.write_bytes(b"%PDF-1.4")
monkeypatch.setattr("gateway.platforms.base._HERMES_HOME", hermes_dir)
monkeypatch.setattr("gateway.platforms.base._HERMES_ROOT", hermes_dir)
monkeypatch.setenv("HERMES_MEDIA_ALLOW_DIRS", str(export_root))

assert BasePlatformAdapter.validate_media_delivery_path(str(report)) == str(report.resolve())

def test_strict_mode_envvar_restores_legacy_behavior(self, tmp_path, monkeypatch):
"""Setting HERMES_MEDIA_DELIVERY_STRICT=1 reactivates the older
allowlist+recency logic. A stale file outside the allowlist is
Expand Down
Loading