Repository navigation
fix(security): guard cron script against path traversal and redact output - #5147
Merged
Merged
Conversation
…tput Relative script paths resolved against HERMES_HOME/scripts/ were not validated to stay within that directory. Paths like '../../etc/passwd' could escape and be executed as Python. Fix: resolve the path and verify it stays within scripts_dir using Path.relative_to(). Also apply redact_sensitive_text() to script stdout before LLM injection — same pattern as execute_code sandbox output. Cherry-picked from PR #5093 by memosr (fixes 1 and 3; absolute path restriction dropped as too restrictive for the feature's design intent).
7 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Salvage of PR #5093 by memosr (fixes 1 and 3; absolute path restriction dropped).
1. Path Traversal Guard (relative paths)
Relative script paths resolved against
HERMES_HOME/scripts/were not validated to stay within that directory.../../etc/passwdwould resolve outside and be executed as Python.Fix: After resolving, verify the path stays within
scripts_dirusingPath.relative_to(). Paths that escape are rejected.2. Secret Redaction
Script stdout was injected raw into the LLM prompt. If a script outputs env vars or API keys, they flow unmasked into context.
Fix: Apply
redact_sensitive_text()to stdout before injection — same pattern as execute_code sandbox output.What was dropped
The absolute path restriction to HERMES_HOME was dropped — it's too restrictive for the feature's design intent. Users may legitimately want to point cron scripts at paths outside
~/.hermes/. The agent already has full terminal access, so this doesn't close a meaningful security boundary.Test plan
Credit: memosr (original PR #5093)