Gutslabs 0f2ea2062b fix(profiles): validate tar archive member paths on import ... Fixes a zip-slip path traversal vulnerability in hermes profile import. shutil.unpack_archive() on untrusted tar members allows entries like ../../escape.txt to write files outside ~/.hermes/profiles/. - Add _normalize_profile_archive_parts() to reject absolute paths (POSIX and Windows), traversal (..), empty paths, backslash tricks - Add _safe_extract_profile_archive() for manual per-member extraction that only allows regular files and directories (rejects symlinks) - Replace shutil.unpack_archive() with the safe extraction path - Add regression tests for traversal and absolute-path attacks Co-authored-by: Gutslabs <gutslabsxyz@gmail.com>		2026-03-31 12:14:27 -07:00
..
__init__.py
test_banner_skills.py
test_banner.py
test_chat_skills_flag.py
test_claw.py	feat: add post-migration cleanup for OpenClaw directories (#4100)	2026-03-30 17:39:08 -07:00
test_cmd_update.py	fix(update): skip config migration prompts in non-interactive sessions (#3584)	2026-03-28 14:26:32 -07:00
test_coalesce_session_args.py
test_commands.py	fix(telegram): enforce 32-char limit on command names with collision avoidance (#4211)	2026-03-31 02:41:50 -07:00
test_config.py
test_copilot_auth.py
test_cron.py
test_doctor.py
test_env_loader.py
test_gateway_linger.py
test_gateway_runtime_health.py
test_gateway_service.py	fix: replace hardcoded ~/.hermes paths with get_hermes_home() for profile support	2026-03-28 13:51:08 -07:00
test_gateway.py
test_launcher.py	fix: use argparse entrypoint in top-level launcher (#3874)	2026-03-29 21:54:36 -07:00
test_managed_installs.py	chore: prepare Hermes for Homebrew packaging (#4099)	2026-03-30 17:34:43 -07:00
test_mcp_config.py
test_mcp_tools_config.py
test_model_validation.py	feat(model): /model command overhaul — Phases 2, 3, 5	2026-03-24 06:58:04 -07:00
test_models.py
test_path_completion.py
test_placeholder_usage.py
test_profiles.py	fix(profiles): validate tar archive member paths on import	2026-03-31 12:14:27 -07:00
test_session_browse.py
test_sessions_delete.py	fix(cli): handle EOFError in sessions delete/prune confirmation prompts (#3101)	2026-03-25 18:06:04 -07:00
test_set_config_value.py	fix(cli): allow empty strings and falsy values in config set	2026-03-31 11:41:12 -07:00
test_setup_model_provider.py	feat(auth): same-provider credential pools with rotation, custom endpoint support, and interactive CLI (#2647)	2026-03-31 03:10:01 -07:00
test_setup_noninteractive.py
test_setup_openclaw_migration.py	fix: OpenClaw migration overwrites defaults and setup wizard skips imported sections (#3282)	2026-03-26 16:29:38 -07:00
test_setup_prompt_menus.py
test_setup.py	refactor: unify setup wizard provider selection with hermes model	2026-03-31 01:04:07 -07:00
test_skills_config.py
test_skills_hub.py	fix(skills): preserve trust for skills-sh identifiers + reduce resolution churn (#3251)	2026-03-26 13:40:21 -07:00
test_skills_install_flags.py
test_skills_skip_confirm.py	fix(skills): cache-aware /skills install and uninstall in TUI (#3586)	2026-03-28 14:32:23 -07:00
test_skills_subparser.py
test_skin_engine.py
test_status_model_provider.py
test_status.py
test_subprocess_timeouts.py	fix(cli): add missing subprocess.run() timeouts in doctor and status (#4009)	2026-03-30 11:17:15 -07:00
test_tool_token_estimation.py	fix(tests): resolve 10 CI failures across hooks, tiktoken, plugins (#3848)	2026-03-29 20:05:59 -07:00
test_tools_config.py	fix: add missing mattermost/matrix/dingtalk toolsets + platform consistency tests (salvage #3512) (#3583)	2026-03-28 14:05:02 -07:00
test_tools_disable_enable.py	fix: MCP toolset resolution for runtime and config (#3252)	2026-03-26 13:39:41 -07:00
test_update_autostash.py	fix: harden hermes update against diverged history, non-main branches, and gateway edge cases (salvage #3489) (#3492)	2026-03-27 23:12:43 -07:00
test_update_check.py
test_update_gateway_restart.py	fix(gateway): use setsid instead of systemd-run --user for /update (salvage #4024) (#4104)	2026-03-30 20:22:09 -07:00
test_webhook_cli.py	feat(webhook): hermes webhook CLI + skill for event-driven subscriptions (#3578)	2026-03-28 14:33:35 -07:00