common/hermes
2
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix(security): isolate interactive sudo password cache per session

Browse Source
This commit is contained in:
hharry11
2026-04-28 09:28:19 +03:00
committed by Teknium
parent efb7d27609
commit de03a332f7
3 changed files with 102 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
tests/tools/test_terminal_tool.py
View File

@@ -4,11 +4,11 @@ import tools.terminal_tool as terminal_tool
def setup_function():
terminal_tool._cached_sudo_password = ""
terminal_tool._reset_cached_sudo_passwords()
def teardown_function():
terminal_tool._cached_sudo_password = ""
terminal_tool._reset_cached_sudo_passwords()
def test_searching_for_sudo_does_not_trigger_rewrite(monkeypatch):
@@ -82,7 +82,7 @@ def test_explicit_empty_sudo_password_tries_empty_without_prompt(monkeypatch):
def test_cached_sudo_password_is_used_when_env_is_unset(monkeypatch):
monkeypatch.delenv("SUDO_PASSWORD", raising=False)
monkeypatch.delenv("HERMES_INTERACTIVE", raising=False)
terminal_tool._cached_sudo_password = "cached-pass"
terminal_tool._set_cached_sudo_password("cached-pass")
transformed, sudo_stdin = terminal_tool._transform_sudo_command("echo ok && sudo whoami")
@@ -90,6 +90,20 @@ def test_cached_sudo_password_is_used_when_env_is_unset(monkeypatch):
assert sudo_stdin == "cached-pass\n"
def test_cached_sudo_password_isolated_by_session_key(monkeypatch):
monkeypatch.delenv("SUDO_PASSWORD", raising=False)
monkeypatch.delenv("HERMES_INTERACTIVE", raising=False)
monkeypatch.setenv("HERMES_SESSION_KEY", "session-a")
terminal_tool._set_cached_sudo_password("alpha-pass")
monkeypatch.setenv("HERMES_SESSION_KEY", "session-b")
assert terminal_tool._get_cached_sudo_password() == ""
monkeypatch.setenv("HERMES_SESSION_KEY", "session-a")
assert terminal_tool._get_cached_sudo_password() == "alpha-pass"
def test_validate_workdir_allows_windows_drive_paths():
assert terminal_tool._validate_workdir(r"C:\Users\Alice\project") is None
assert terminal_tool._validate_workdir("C:/Users/Alice/project") is None