common/hermes
2
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix(webhook): enforce INSECURE_NO_AUTH safety rail on dynamic route reloads

Browse Source
This commit is contained in:
Zyrixtrex
2026-05-22 15:52:14 +03:00
committed by Teknium
parent b4cf5b65dd
commit 61ac118724
2 changed files with 22 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
tests/gateway/test_webhook_dynamic_routes.py
View File

@@ -138,10 +138,20 @@ class TestDynamicRouteSecretValidation:
(tmp_path / _DYNAMIC_ROUTES_FILENAME).write_text(
json.dumps({"test": {"secret": _INSECURE_NO_AUTH, "prompt": "p"}})
)
adapter = _make_adapter()
adapter = _make_adapter(extra={"host": "127.0.0.1"})
adapter._reload_dynamic_routes()
assert "test" in adapter._routes
def test_insecure_no_auth_rejected_on_non_loopback_bind(self, tmp_path):
# Dynamic INSECURE_NO_AUTH routes are only valid on loopback hosts.
(tmp_path / _DYNAMIC_ROUTES_FILENAME).write_text(
json.dumps({"pub": {"secret": _INSECURE_NO_AUTH, "prompt": "p"}})
)
adapter = _make_adapter(extra={"host": "0.0.0.0"})
adapter._reload_dynamic_routes()
assert "pub" not in adapter._routes
assert "pub" not in adapter._dynamic_routes
def test_warning_logged_on_skip(self, tmp_path, caplog):
import logging
(tmp_path / _DYNAMIC_ROUTES_FILENAME).write_text(