David/HERMES-GIELIE
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
HERMES-GIELIE/tests
History
nesquena-hermes a064542df9
release: v0.39.0 — security hardening, 12 fixes (#171) 
* Security: harden auth, CSRF, SSRF, XSS, and env race conditions

Twelve fixes from a full security audit:

CRITICAL
- Add CSRF Origin/Referer validation on all POST endpoints
  (prevents cross-origin abuse of self-update, settings, file ops)

HIGH
- Unify password hashing: config.py now uses PBKDF2 (600k iters)
  instead of single-iteration SHA-256
- Add per-IP rate limiting on login (5 attempts/60s, 429 on excess)

MEDIUM
- Validate session IDs as hex-only before filesystem operations
  (prevents path traversal via crafted session ID)
- SSRF: resolve DNS before private-IP check in model fetching
  (prevents DNS rebinding to internal services)
- Warn loudly when binding non-loopback without password set
- SSE env var mutations: wrap sync chat + streaming restore in _ENV_LOCK
- Force Content-Disposition:attachment for HTML/XHTML/SVG uploads
  (prevents stored XSS via uploaded files)

LOW
- Extend HMAC session signature from 64 to 128 bits
- Add resolve()+relative_to() check on skills path construction
- Set Secure flag on session cookie when connection is HTTPS
- Sanitize exception messages to strip filesystem paths

No breaking changes. All fixes are backward-compatible.

* fix: use getattr for Secure cookie SSL detection

handler.request.getpeercert raises AttributeError on plain sockets
(non-SSL). Use getattr(..., None) to safely check for SSL.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* tests: add sprint 29 security hardening coverage (PR #171)

33 tests covering all 12 security fixes:
- CSRF origin/referer validation
- Login rate limiting (5 attempts/60s)
- Session ID hex validation (path traversal prevention)
- Error path sanitization (_sanitize_error)
- Secure cookie getattr safety
- HMAC signature length (64->128 bit)
- Skills path traversal prevention
- Content-Disposition for HTML/SVG/XHTML
- PBKDF2 password hashing verification
- Non-loopback startup warning
- SSRF DNS guard code presence
- _ENV_LOCK export from streaming module

* release: v0.39.0 — security hardening, 12 fixes (#171)

---------

Co-authored-by: betamod <matthew.sloly@gmail.com>
Co-authored-by: Nathan Esquenazi <nesquena@gmail.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-07 22:26:03 -07:00
..
__init__.py
conftest.py fix: auto-skip agent-dependent tests when hermes-agent not installed (#86) 2026-04-04 14:51:15 -07:00
test_model_resolver.py fix: model selector duplicate + stale model label (#147) (#151) 2026-04-06 14:15:24 -07:00
test_regressions.py fix: stop leaking stack traces to clients in HTTP 500 responses 2026-04-03 06:41:32 -07:00
test_sprint1.py Hermes Web UI — Sprints 11-14: multi-provider models, settings, session QoL, alerts, polish 2026-03-31 07:02:47 +00:00
test_sprint2.py
test_sprint3.py
test_sprint4.py
test_sprint5.py
test_sprint6.py
test_sprint7.py
test_sprint8.py
test_sprint9.py
test_sprint10.py
test_sprint11.py Hermes Web UI — Sprints 11-14: multi-provider models, settings, session QoL, alerts, polish 2026-03-31 07:02:47 +00:00
test_sprint12.py Hermes Web UI — Sprints 11-14: multi-provider models, settings, session QoL, alerts, polish 2026-03-31 07:02:47 +00:00
test_sprint13.py Hermes Web UI — Sprints 11-14: multi-provider models, settings, session QoL, alerts, polish 2026-03-31 07:02:47 +00:00
test_sprint14.py Hermes Web UI — Sprints 11-14: multi-provider models, settings, session QoL, alerts, polish 2026-03-31 07:02:47 +00:00
test_sprint15.py feat: Sprint 15 — session projects, code copy button, tool card toggle 2026-04-02 00:11:49 -07:00
test_sprint16.py feat: safe HTML rendering in AI responses + active session gold style + Sprint 16 tests 2026-04-03 00:27:43 +00:00
test_sprint17.py feat: Sprint 17 -- workspace breadcrumbs, slash commands, send key setting 2026-04-03 04:13:38 -07:00
test_sprint19.py fix(auth): harden password_hash handling in settings API 2026-04-03 06:21:04 -07:00
test_sprint20.py fix: mic appends to existing textarea text instead of replacing it 2026-04-03 14:13:29 +00:00
test_sprint20b.py fix: test_send_pop_in keyframe parser hit wrong @keyframes block 2026-04-03 14:23:56 +00:00
test_sprint23.py fix: test hardening for sprint 23 — handle missing cron/skills modules in test env 2026-04-03 19:16:17 -07:00
test_sprint26.py fix: settings unsaved-changes guard, add Slate theme, improve Light theme 2026-04-05 04:00:24 +00:00
test_sprint27.py fix: harden bot_name — crash guard, XSS escape, sanitization, tests 2026-04-06 15:06:16 +00:00
test_sprint28.py fix: personalities from config.yaml + ephemeral_system_prompt (#139) (#148) 2026-04-06 14:10:30 -07:00
test_sprint29.py release: v0.39.0 — security hardening, 12 fixes (#171) 2026-04-07 22:26:03 -07:00