fix(security): deny WhatsApp Baileys session directory in media delivery - #51247
Open
srojk34 wants to merge 1 commit into
Open
fix(security): deny WhatsApp Baileys session directory in media delivery#51247srojk34 wants to merge 1 commit into
srojk34 wants to merge 1 commit into
Conversation
…ery (NousResearch#51055 sibling) The media-delivery denylist in _media_delivery_denied_paths() was missing the WhatsApp Baileys auth-state directory (whatsapp/session/). Files under this path — notably creds.json (noise key, signed identity and pre-keys, registration) — could be auto-attached to a chat reply via prompt injection in non-strict (default) mode, leaking a full WhatsApp account credential. Add whatsapp/session to _ROOT_CREDENTIAL_DIRS alongside the existing pairing/ entry. Two regression tests (creds.json + lid-mapping-*.json). 162/162 passing, 0 failed. Negative check confirms tests fail on main.
alt-glitch
added
type/security
teknium1
reviewed
Jul 15, 2026
teknium1
left a comment
teknium1
left a comment
Contributor
There was a problem hiding this comment.
Thanks for identifying the Baileys credential-delivery risk. The targeted denylist approach fits the existing media-delivery design, but the current patch misses the session directory used by fresh installs.
Problems
gateway/platforms/base.pyadds onlywhatsapp/session. The Baileys adapter defaults toget_hermes_dir("platforms/whatsapp/session", "whatsapp/session")atplugins/platforms/whatsapp/adapter.py:404-407;get_hermes_dir()returns the modern path unless the legacy directory has content (hermes_constants.py:226-253).platforms/whatsapp/sessionis still absent from_ROOT_CREDENTIAL_DIRSatgateway/platforms/base.py:1194-1197, while default-mode validation permits existing files not under that denylist (gateway/platforms/base.py:1264-1325).- The added tests cover only the legacy layout. Please cover
platforms/whatsapp/sessiontoo;tests/gateway/test_unauthorized_dm_behavior.py:103-120already establishes it as the modern layout.
Suggested changes
- Deny both modern and legacy session paths, and add tests for each.
Automated hermes-sweeper review.
| # WhatsApp Baileys auth state (noise key, signed identity/pre-keys, | ||
| # registration). creds.json + session keys let an attacker hijack | ||
| # the paired WhatsApp account. | ||
| os.path.join("whatsapp", "session"), |
Contributor
There was a problem hiding this comment.
This covers only the legacy path. The current Baileys adapter defaults to get_hermes_dir("platforms/whatsapp/session", "whatsapp/session") (plugins/platforms/whatsapp/adapter.py:404-407), so fresh installs still permit platforms/whatsapp/session/creds.json. Please deny both layouts.
teknium1
added
sweeper:risk-compatibility
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The media-delivery denylist (
_media_delivery_denied_paths()ingateway/platforms/base.py) was missing the WhatsApp Baileys auth-state directory (whatsapp/session/). Files under this path — notablycreds.json(noise key, signed identity/pre-keys, registration) — could be auto-attached to a chat reply via prompt injection in non-strict (default) mode, leaking a full WhatsApp account credential.The session directory is created by
hermes_cli/main.py:2570(get_hermes_home() / "whatsapp" / "session") and read bygateway/whatsapp_identity.py:136andhermes_cli/gateway.py:4569. It was not covered by any existing denylist entry, nor by the sibling PRs (#37222 formcp-tokens/, #41071 forstate.db/kanban.db).Changes
gateway/platforms/base.py: addwhatsapp/sessionto_ROOT_CREDENTIAL_DIRSalongside the existingpairing/entry.tests/gateway/test_platform_base.py: 2 regression tests —creds.jsonandlid-mapping-*.jsonboth blocked.Validation
~/.hermes/whatsapp/session/creds.json~/.hermes/whatsapp/session/lid-mapping-12345.json~/.hermes/cache/documents/report.pdftests/gateway/test_platform_base.py→ 162 passed, 0 failed.mainwithout the fix. ✓ruff checkclean.Sibling of #51055. Follows the per-file/per-dir enumeration shape accepted by maintainers (#32090, #34425).