ling/hermes-agent
1
0
Fork 0
mirror of https://github.com/NousResearch/hermes-agent.git synced 2026-04-28 06:51:16 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): validate cron deliver platform name to prevent env var enumeration

Browse Source
This commit is contained in:
Maymun
2026-04-04 23:38:55 +03:00
committed by Teknium
parent ef3bd3b276
commit 1ebc932417
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
cron/scheduler.py
View File

@@ -135,7 +135,14 @@ def _resolve_delivery_target(job: dict) -> Optional[dict]:
"thread_id": origin.get("thread_id"),
}
chat_id = os.getenv(f"{platform_name.upper()}_HOME_CHANNEL", "")
_KNOWN_PLATFORMS = {
"telegram", "discord", "slack", "whatsapp", "signal",
"matrix", "mattermost", "dingtalk", "feishu", "wecom",
"sms", "email", "webhook",
}
if platform_name.lower() not in _KNOWN_PLATFORMS:
return None
chat_id = os.getenv(f"{platform_name.upper()}_HOME_CHANNEL", "")
if not chat_id:
return None