memosr
ed3d12a762
fix(security): fail-closed when WebSocket peer is empty in loopback mode
...
Per @egilewski's audit on this PR (#15544 ), the original fix was
correct but the file has refactored since: the four endpoint-local
empty-peer checks have been consolidated into _ws_client_is_allowed
and _ws_client_reason, but the helpers were left fail-open ('no peer
host known means allow' / 'no reason to block').
On a loopback-bound dashboard with auth disabled, an ASGI server
behind a misconfigured proxy or a unix-socket transport can deliver
ws.client == None or ws.client.host == ''. The helpers were treating
that as 'allowed', so the loopback-only peer gate could be bypassed
by anything that suppressed the client tuple in transit. All four
WebSocket endpoints (/api/pty, /api/ws, /api/pub, /api/events) route
through _ws_request_is_allowed -> _ws_client_is_allowed, so the gap
applied uniformly.
Fix:
* _ws_client_is_allowed: return False when client_host is empty
instead of True. Only reached on loopback bind with auth disabled
(auth_required=True and explicit non-loopback binds short-circuit
earlier), so the fail-closed behavior is scoped to the surface
that needs it.
* _ws_client_reason: return a 'missing_or_empty_peer bound=...'
block reason instead of None, so the dispatcher's existing
reason-based rejection path picks it up and the close gets logged
with a machine-parseable token for diagnosability.
Behavior unchanged for:
* gated mode (auth_required=True) — early-returns True before the
empty-peer check runs. The OAuth ticket is the auth at that point.
* explicit non-loopback bind (--host 0.0.0.0/::, or a specific LAN
address, always with --insecure) — early-returns True before the
empty-peer check runs. DNS-rebinding is still blocked by the
Host/Origin guard in _ws_host_origin_is_allowed.
* legitimate loopback peers (client_host == '127.0.0.1' / '::1') —
not affected by the empty-peer branch.
Regression tests added in tests/hermes_cli/test_dashboard_auth_ws_auth.py:
* test_empty_client_host_rejected_in_loopback_mode
* test_missing_client_object_rejected_in_loopback_mode
* test_empty_client_host_reason_is_block
Plus two regression guards to ensure the fix does not over-reach:
* test_empty_client_host_still_allowed_in_insecure_public_mode
* test_empty_client_host_still_allowed_in_gated_mode
All three new fail-closed tests fail without this patch (the helpers
return True / None for an empty peer) and pass with it. The 45
pre-existing tests in test_dashboard_auth_ws_auth.py continue to pass.
2026-06-21 13:33:18 -07:00
..
2026-05-27 02:12:27 -07:00
2026-06-08 22:54:25 -07:00
2026-06-08 15:12:12 -07:00
2026-05-28 22:26:25 -07:00
2026-05-25 01:20:33 -07:00
2026-06-09 14:45:19 -07:00
2026-06-04 05:53:35 -07:00
2026-04-26 05:43:31 -07:00
2026-06-15 05:36:20 +00:00
2026-05-27 00:43:32 -07:00
2026-05-28 22:26:25 -07:00
2026-04-21 14:31:48 -05:00
2026-06-01 09:57:10 -07:00
2026-05-28 22:26:25 -07:00
2026-06-17 05:48:35 -07:00
2026-06-13 05:15:26 -07:00
2026-06-16 05:56:11 -07:00
2026-05-28 22:26:25 -07:00
2026-06-09 23:21:24 -07:00
2026-05-29 02:24:48 -07:00
2026-06-04 16:54:40 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-04-24 03:00:33 -07:00
2026-05-08 14:27:40 -07:00
2026-05-24 04:25:32 -07:00
2026-06-15 05:40:23 -07:00
2026-05-18 20:01:34 -07:00
2026-05-18 10:14:38 -07:00
2026-05-28 22:26:25 -07:00
2026-06-21 12:44:22 -07:00
2026-05-28 15:14:05 +10:00
2026-05-15 14:45:43 -07:00
2026-05-28 22:26:25 -07:00
2026-06-11 09:01:52 -07:00
2026-05-28 22:26:25 -07:00
2026-06-19 01:53:32 +05:30
2026-06-19 01:53:32 +05:30
2026-06-19 01:53:32 +05:30
2026-05-28 15:14:05 +10:00
2026-05-28 22:26:25 -07:00
2026-04-29 23:18:55 -07:00
2026-05-28 22:26:25 -07:00
2026-06-08 15:12:12 -07:00
2026-05-25 01:20:33 -07:00
2026-06-12 13:42:42 -04:00
2026-06-06 18:22:20 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-06-10 00:24:06 -07:00
2026-05-28 22:26:25 -07:00
2026-05-17 02:29:41 -07:00
2026-06-12 08:51:10 +00:00
2026-05-13 09:34:15 -07:00
2026-04-21 14:23:45 -07:00
2026-05-28 22:26:25 -07:00
2026-04-17 19:03:26 -07:00
2026-05-28 22:26:25 -07:00
2026-06-19 07:35:06 -07:00
2026-04-29 23:18:55 -07:00
2026-06-15 20:51:48 +10:00
2026-06-21 16:31:56 +05:30
2026-05-28 22:26:25 -07:00
2026-04-28 01:18:09 -07:00
2026-04-24 05:09:08 -07:00
2026-05-29 23:45:05 -07:00
2026-04-24 05:09:08 -07:00
2026-06-19 12:43:30 +10:00
2026-06-11 05:01:25 +00:00
2026-06-10 20:46:17 -07:00
2026-05-28 22:26:25 -07:00
2026-05-09 18:43:40 -07:00
2026-05-07 05:27:47 -07:00
2026-05-07 05:27:47 -07:00
2026-06-07 18:21:03 -07:00
2026-06-07 18:21:03 -07:00
2026-06-01 16:58:58 -07:00
2026-06-01 16:58:58 -07:00
2026-04-25 18:47:53 -07:00
2026-06-13 05:51:05 -07:00
2026-06-06 01:29:41 +05:30
2026-06-18 09:40:56 -07:00
2026-06-02 21:16:41 +10:00
2026-05-27 02:12:27 -07:00
2026-05-28 22:26:25 -07:00
2026-06-12 14:02:19 -04:00
2026-06-09 22:57:49 -07:00
2026-06-04 01:02:25 -07:00
2026-05-27 02:12:27 -07:00
2026-06-10 12:14:57 +10:00
2026-05-27 02:12:27 -07:00
2026-06-13 07:18:59 -07:00
2026-05-27 02:12:27 -07:00
2026-06-21 13:33:18 -07:00
2026-06-02 23:43:27 -07:00
2026-04-30 06:43:22 -04:00
2026-06-04 03:03:35 -07:00
2026-05-12 13:59:22 -04:00
2026-06-09 13:56:33 +10:00
2026-06-06 12:43:28 -05:00
2026-06-15 15:33:15 +10:00
2026-06-19 07:05:42 -07:00
2026-06-02 20:49:44 -05:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-05-09 11:04:46 -07:00
2026-06-14 02:09:16 -07:00
2026-04-20 22:14:29 -07:00
2026-04-17 05:08:07 -07:00
2026-05-03 03:25:45 -07:00
2026-05-28 22:26:25 -07:00
2026-05-09 13:36:33 -07:00
2026-06-15 12:24:46 -07:00
2026-06-17 16:53:42 -07:00
2026-06-15 12:31:23 -07:00
2026-06-01 13:27:30 +10:00
2026-06-10 02:21:00 -07:00
2026-05-13 18:40:14 -07:00
2026-05-28 22:26:25 -07:00
2026-05-04 15:31:15 -04:00
2026-05-28 22:26:25 -07:00
2026-06-11 06:10:08 -07:00
2026-05-28 22:26:25 -07:00
2026-05-09 17:54:17 -07:00
2026-06-19 11:53:44 +05:30
2026-06-17 05:40:57 -07:00
2026-06-02 11:59:27 +10:00
2026-05-28 22:26:25 -07:00
2026-06-17 05:19:21 -07:00
2026-06-03 19:37:29 -07:00
2026-06-06 19:53:58 -07:00
2026-06-18 12:01:54 +10:00
2026-04-24 04:46:17 -07:00
2026-06-13 13:47:08 -07:00
2026-05-29 23:45:05 -07:00
2026-06-20 20:06:24 -07:00
2026-05-29 01:23:06 -07:00
2026-06-17 18:48:35 -05:00
2026-06-06 18:22:38 -07:00
2026-05-28 22:26:25 -07:00
2026-04-29 20:33:29 -07:00
2026-05-28 00:19:31 -07:00
2026-05-21 19:17:45 -07:00
2026-05-31 17:46:56 -05:00
2026-06-18 21:37:41 -07:00
2026-05-30 01:40:57 -07:00
2026-05-18 20:17:10 -07:00
2026-05-28 21:00:46 -07:00
2026-06-04 07:39:53 -07:00
2026-06-07 23:14:18 -07:00
2026-05-30 01:40:49 -07:00
2026-06-21 12:43:41 -07:00
2026-06-01 20:26:57 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 19:02:55 -07:00
2026-05-18 20:47:01 -07:00
2026-06-21 12:06:24 -07:00
2026-05-31 01:16:33 -07:00
2026-06-21 12:43:41 -07:00
2026-06-21 12:38:14 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 19:02:55 -07:00
2026-05-23 23:10:36 -07:00
2026-06-21 12:49:07 -07:00
2026-05-07 13:04:41 -07:00
2026-05-07 13:04:41 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 17:50:42 -07:00
2026-06-13 05:50:09 -07:00
2026-06-21 12:43:37 -07:00
2026-05-06 03:50:59 -07:00
2026-06-20 10:26:45 -07:00
2026-05-19 01:28:32 -07:00
2026-06-19 07:46:33 -07:00
2026-06-19 07:46:33 -07:00
2026-06-19 07:46:33 -07:00
2026-06-19 07:46:33 -07:00
2026-06-19 07:46:33 -07:00
2026-06-19 07:46:33 -07:00
2026-06-19 07:46:33 -07:00
2026-06-19 07:46:33 -07:00
2026-06-19 07:46:33 -07:00
2026-06-05 07:54:08 -05:00
2026-06-11 08:59:55 -07:00
2026-06-14 04:24:14 -07:00
2026-06-15 04:22:07 -07:00
2026-05-28 22:26:25 -07:00
2026-06-14 04:46:54 -07:00
2026-05-30 07:45:26 -07:00
2026-05-28 22:26:25 -07:00
2026-06-18 16:48:47 -05:00
2026-05-28 22:26:25 -07:00
2026-06-04 14:03:02 +10:00
2026-06-17 01:04:26 +08:00
2026-05-20 09:18:23 -07:00
2026-06-18 13:47:31 -07:00
2026-06-10 00:24:06 -07:00
2026-06-13 13:47:08 -07:00
2026-06-19 07:07:06 -07:00
2026-04-17 06:33:21 -07:00
2026-05-31 03:19:37 -07:00
2026-04-25 18:47:53 -07:00
2026-04-16 01:16:14 -07:00
2026-06-13 06:05:30 -07:00
2026-04-24 04:58:46 -07:00
2026-06-19 07:07:06 -07:00
2026-06-14 02:09:16 -07:00
2026-06-16 23:25:07 +05:30
2026-06-04 17:29:31 -07:00
2026-05-28 22:26:25 -07:00
2026-06-12 08:51:10 +00:00
2026-06-15 23:24:55 -05:00
2026-06-20 10:53:45 -07:00
2026-06-11 07:51:01 -07:00
2026-06-05 06:43:51 -07:00
2026-05-29 23:45:05 -07:00
2026-05-09 23:17:25 -07:00
2026-06-02 06:31:37 -07:00
2026-05-06 09:08:33 -07:00
2026-05-17 02:29:41 -07:00
2026-04-21 05:19:43 -07:00
2026-05-28 22:26:25 -07:00
2026-06-17 12:33:56 +05:30
2026-06-05 06:55:09 -07:00
2026-05-05 04:37:47 -07:00
2026-06-18 14:14:41 +10:00
2026-05-23 17:49:47 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-06-07 08:02:55 +00:00
2026-06-08 17:57:37 +05:30
2026-06-08 17:57:37 +05:30
2026-06-13 13:23:59 -07:00
2026-05-25 01:41:19 -07:00
2026-05-24 18:04:54 -07:00
2026-06-21 12:54:40 -07:00
2026-05-09 13:02:25 -07:00
2026-05-17 13:54:12 -07:00
2026-06-07 21:50:57 -07:00
2026-05-28 22:26:25 -07:00
2026-06-15 11:43:23 +10:00
2026-06-19 07:34:15 -07:00
2026-05-28 22:26:25 -07:00
2026-05-25 01:20:33 -07:00
2026-05-30 02:53:42 -07:00
2026-06-19 07:26:46 -07:00
2026-05-28 22:26:25 -07:00
2026-05-31 15:02:26 -07:00
2026-06-16 23:25:07 +05:30
2026-06-19 07:26:46 -07:00
2026-05-29 02:24:48 -07:00
2026-05-28 02:36:09 -07:00
2026-06-08 07:03:12 -07:00
2026-05-31 03:19:37 -07:00
2026-05-07 05:10:33 -07:00
2026-05-28 22:26:25 -07:00
2026-05-08 14:27:40 -07:00
2026-04-27 08:52:12 -07:00
2026-06-08 10:01:47 -07:00
2026-05-28 03:34:47 -07:00
2026-06-10 14:39:03 -07:00
2026-06-13 02:36:09 -07:00
2026-06-17 01:04:26 +08:00
2026-06-06 18:36:40 -07:00
2026-05-12 01:02:25 -07:00
2026-05-28 22:26:25 -07:00
2026-06-12 11:48:06 -07:00
2026-06-18 10:49:02 +10:00
2026-05-28 22:26:25 -07:00
2026-05-10 13:06:25 -07:00
2026-05-28 22:26:25 -07:00
2026-04-26 18:31:07 -07:00
2026-06-21 11:50:31 -07:00
2026-05-02 02:08:06 -07:00
2026-06-20 10:45:55 -07:00
2026-05-15 10:36:38 +05:30
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-06-01 16:58:58 -07:00
2026-06-05 04:06:17 -07:00
2026-05-28 22:26:25 -07:00
2026-06-08 09:42:44 -07:00
2026-05-19 01:28:32 -07:00
2026-05-25 01:20:33 -07:00
2026-05-31 09:13:06 -07:00
2026-06-20 10:26:45 -07:00
2026-05-28 11:59:58 -07:00
2026-06-14 22:54:54 +05:30
2026-06-10 01:02:40 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-05-08 17:01:12 -07:00
2026-06-20 23:23:47 -07:00
2026-05-08 16:07:23 -07:00
2026-06-10 21:39:22 -04:00
2026-06-04 01:19:28 +05:30
2026-06-17 12:55:40 +05:30
2026-06-07 22:56:23 -07:00
2026-06-18 12:01:54 +10:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-06-11 19:06:29 -04:00
2026-06-07 21:50:57 -07:00
2026-05-08 11:18:14 -07:00
2026-06-14 03:08:52 -07:00
2026-05-28 22:26:25 -07:00
2026-06-10 00:24:06 -07:00
2026-05-25 01:47:55 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-06-17 07:11:23 -07:00
2026-05-24 18:04:54 -07:00
2026-05-28 22:26:25 -07:00
2026-06-03 16:40:28 -07:00
2026-05-27 22:03:45 -05:00
2026-06-21 13:10:22 -07:00
2026-06-09 00:31:27 -07:00
2026-06-04 02:31:49 -07:00
2026-06-15 06:18:27 -07:00
2026-06-11 12:45:07 +05:30
2026-06-13 10:46:08 -07:00
2026-06-19 19:58:26 -07:00
2026-05-28 22:26:25 -07:00
2026-06-10 02:57:05 -07:00
2026-06-18 12:42:58 +05:30
2026-05-19 03:01:02 -07:00
2026-06-03 04:59:49 -07:00
2026-05-08 14:55:40 -07:00
2026-06-21 13:10:22 -07:00
2026-05-28 22:26:25 -07:00
2026-06-16 13:07:52 -07:00
2026-06-04 23:20:29 -04:00
2026-06-06 12:50:58 -05:00
2026-05-15 12:11:32 -07:00
2026-05-06 15:49:59 -07:00
2026-06-19 07:26:46 -07:00
2026-06-21 12:29:18 -07:00
2026-05-25 01:15:24 -07:00
2026-06-18 11:32:18 +05:30
2026-06-11 09:41:35 -07:00
2026-05-24 15:00:44 -07:00
2026-06-17 05:40:57 -07:00
2026-05-24 17:47:24 -07:00
2026-06-17 05:40:57 -07:00
2026-06-08 11:32:43 -07:00
2026-06-04 07:49:34 -07:00
2026-06-11 06:10:27 -07:00
2026-06-12 12:58:36 -07:00
2026-06-21 17:22:52 +05:30
2026-06-11 11:49:08 -07:00
2026-05-28 22:26:25 -07:00
2026-05-23 01:07:01 -04:00
2026-05-28 22:26:25 -07:00
2026-06-08 11:32:43 -07:00
2026-06-07 18:28:23 -07:00
2026-06-17 09:49:46 -07:00
2026-06-09 23:21:24 -07:00
2026-05-17 12:35:01 -07:00
2026-06-15 17:03:35 +05:30
2026-06-15 05:40:23 -07:00
2026-06-15 17:08:19 +05:30
2026-05-24 18:12:16 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00