fix(safety): casefold credential path guards - #52045
Open
lin-hongkuan wants to merge 1 commit into
Open
Conversation
alt-glitch
added
type/security
Collaborator
Duplicate of #51475 — same fix for #51474 (casefold credential deny-path comparisons on case-insensitive filesystems), touching the same files ( |
13 tasks
Contributor
|
Thanks for covering the write, read, and media-delivery deny paths together. The underlying issue is still present on current main: Problems
Suggested changes
Automated hermes-sweeper review. |
teknium1
added
sweeper:risk-platform-windows
bbasketballer75
added a commit
to bbasketballer75/hermes-agent
that referenced
this pull request
Aug 13, 2026
_MEDIA_DELIVERY_DENIED_PREFIXES is POSIX-only, and the entries do not degrade
gracefully. Path("/etc").resolve() becomes C:\etc on the current drive, which
does not exist -- so on Windows every entry in that tuple is inert and the
default-mode denylist is effectively empty.
Measured on Windows against unmodified main:
/etc -> C:\etc exists=False
/sys -> C:\sys exists=False
/root -> C:\root exists=False
... all nine resolve to nonexistent paths
C:\Windows covered=False
C:\ProgramData covered=False
Consequence, verified end-to-end through the guard itself:
validate_media_delivery_path(r"C:\Windows\win.ini")
before -> <path> (deliverable as a gateway attachment)
after -> None (refused)
Strict mode was unaffected -- the ~/.ssh denial works, because those entries
are built from the live $HOME rather than hard-coded POSIX roots. This is the
default (non-strict) path, which is what most operators run.
Adds two Windows-specific lists:
- system roots resolved from %SystemRoot% and %ProgramData%, read from the
environment rather than hard-coded, because Windows need not live on C:
and a roaming profile need not sit under C:\Users.
- the credential stores under the user profile that have no POSIX
counterpart: Microsoft\Credentials (both roaming and local),
Microsoft\Protect (DPAPI master keys), Microsoft\Crypto, and
Local\Microsoft\Vault. The POSIX dotfile equivalents (.aws, .ssh, .azure,
.gcloud) use the same names on Windows and are already covered by
_MEDIA_DELIVERY_DENIED_HOME_SUBPATHS.
AppData is deliberately NOT denied wholesale. %LOCALAPPDATA%\Temp is a normal
home for generated artifacts, so a blanket rule would break legitimate media
delivery. A test asserts Temp, Pictures and Downloads stay deliverable.
Verification on Windows:
- 9 new tests; 6 of them fail when the production change is reverted, so the
coverage pins real behaviour rather than passing vacuously. The 3 that pass
either way are the must-stay-deliverable assertions.
- tests/gateway/test_platform_base.py: 2 failed before, 2 failed after --
set-diff of failure names is empty, nothing newly broken. Those 2 are
unrelated pre-existing failures.
- ruff clean.
Complementary to (not overlapping) the case-folding work in NousResearch#52045: that PR
rewrites the comparison helpers, this one fixes what is in the list to compare
against. Different hunks in the same file.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.SSH,.AWS,AUTH.JSON,.ENV, and media delivery of case-variant SSH keysFixes #51474.
Tests
python -m pytest tests/tools/test_write_deny.py tests/agent/test_file_safety_credentials.py tests/agent/test_file_safety.py tests/gateway/test_platform_base.py::TestMediaDeliveryDefaultMode tests/gateway/test_platform_base.py::TestMediaDeliveryPathValidation -qpython -m py_compile agent/file_safety.py gateway/platforms/base.pypython scripts/check-windows-footguns.py --all