common/hermes
2
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

fix(security): bind Meet node server to localhost and restrict token file to owner read

Browse Source
This commit is contained in:
memosr
2026-05-04 01:10:50 +03:00
committed by Teknium
parent cdde0c8411
commit 2c7d7a9b2f
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
plugins/google_meet/node/server.py
View File

@@ -43,7 +43,7 @@ class NodeServer:
def __init__( def __init__(
self, self,
host: str = "0.0.0.0", host: str = "127.0.0.1",
port: int = 18789, port: int = 18789,
token_path: Optional[Path] = None, token_path: Optional[Path] = None,
display_name: str = "hermes-meet-node", display_name: str = "hermes-meet-node",
@@ -76,6 +76,13 @@ class NodeServer:
json.dumps({"token": tok, "generated_at": time.time()}, indent=2), json.dumps({"token": tok, "generated_at": time.time()}, indent=2),
encoding="utf-8", encoding="utf-8",
) )
# Restrict to owner-read-write only — the token grants full RPC
# access to the meet bot (start, transcribe, speak in meetings).
try:
tmp.chmod(0o600)
except (OSError, NotImplementedError):
# Best-effort on non-POSIX filesystems; mode is set on POSIX.
pass
tmp.replace(self.token_path) tmp.replace(self.token_path)
self._token = tok self._token = tok
return tok return tok