DasPoschi/hermes-webui
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #3023

Browse Source
This commit is contained in:
nesquena-hermes
2026-05-28 01:58:34 +00:00
parent 1d1daeb6c1 3b93345487
commit 3cb2bd08fb
2 changed files with 29 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
api/models.py
View File

@@ -690,8 +690,10 @@ class Session:
@classmethod
def load(cls, sid):
# Validate session ID format to prevent path traversal
if not sid or not all(c in '0123456789abcdefghijklmnopqrstuvwxyz_' for c in sid):
# Validate session ID format to prevent path traversal. API/gateway
# session ids may contain hyphens (for example ``api-*`` and
# ``reachy-voice-*``); allow those but still reject dots/slashes.
if not sid or not all(c in '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-' for c in sid):
return None
p = SESSION_DIR / f'{sid}.json'
if not p.exists():
@@ -718,7 +720,9 @@ class Session:
top-level "messages" field and synthesize a small metadata-only object.
Falls back to load() for legacy or unexpected file layouts.
"""
if not sid or not all(c in '0123456789abcdefghijklmnopqrstuvwxyz_' for c in sid):
# Same path-safety contract as load(): hyphens are valid session ids,
# path separators and traversal dots are not.
if not sid or not all(c in '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-' for c in sid):
return None
p = SESSION_DIR / f'{sid}.json'
if not p.exists():