common/hermes
2
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix(security): restrict dashboard websockets to loopback clients (#30741)

Browse Source
This commit is contained in:
Teknium
2026-05-24 04:24:40 -07:00
committed by GitHub
parent bc3f1f4f34
commit 9732559864
1 changed files with 1 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
hermes_cli/web_server.py
View File

@@ -3296,19 +3296,11 @@ _VALID_CHANNEL_RE = re.compile(r"^[A-Za-z0-9._-]{1,128}$")
_LOOPBACK_HOSTS = frozenset({"127.0.0.1", "::1", "localhost", "testclient"}) _LOOPBACK_HOSTS = frozenset({"127.0.0.1", "::1", "localhost", "testclient"})
def _is_public_bind() -> bool:
"""True when bound to all-interfaces (operator used --insecure)."""
return getattr(app.state, "bound_host", "") in {"0.0.0.0", "::"}
def _ws_client_is_allowed(ws: "WebSocket") -> bool: def _ws_client_is_allowed(ws: "WebSocket") -> bool:
"""Check if the WebSocket client IP is acceptable. """Check if the WebSocket client IP is acceptable.
Allows loopback always; allows any IP when bound to all-interfaces Allows loopback clients only.
(--insecure mode, guarded by session token auth).
""" """
if _is_public_bind():
return True
client_host = ws.client.host if ws.client else "" client_host = ws.client.host if ws.client else ""
if not client_host: if not client_host:
return True return True