{"record":{"id":"ee77498886088faa","repo":"ZhuLinsen/daily_stock_analysis","slug":"hermes-base-url-must-not-include-userinfo","errorCode":null,"errorMessage":"Hermes BASE_URL must not include userinfo","messagePattern":"Hermes BASE_URL must not include userinfo","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"src/llm/hermes.py","lineNumber":173,"sourceCode":"        raise ValueError(\"Hermes only supports PROTOCOL=openai\")\n    return HERMES_DEFAULT_PROTOCOL\n\n\ndef canonicalize_hermes_base_url(base_url: str) -> str:\n    \"\"\"Return canonical Hermes base URL or raise ValueError.\n\n    Allowed forms are loopback HTTP(S) URLs whose path is exactly /v1 or /v1/.\n    localhost is canonicalized to 127.0.0.1 to avoid DNS/hosts ambiguity.\n    \"\"\"\n\n    raw = (base_url or HERMES_DEFAULT_BASE_URL).strip() or HERMES_DEFAULT_BASE_URL\n    parsed = urlparse(raw)\n    if parsed.scheme.lower() not in {\"http\", \"https\"}:\n        raise ValueError(\"Hermes BASE_URL must use http or https\")\n    if not parsed.netloc or not parsed.hostname:\n        raise ValueError(\"Hermes BASE_URL must include a loopback host\")\n    if parsed.username or parsed.password:\n        raise ValueError(\"Hermes BASE_URL must not include userinfo\")\n    if parsed.params or parsed.query or parsed.fragment:\n        raise ValueError(\"Hermes BASE_URL must not include params, query, or fragment\")\n\n    raw_path = parsed.path or \"\"\n    decoded_path = unquote(raw_path)\n    if decoded_path not in {\"/v1\", \"/v1/\"}:\n        raise ValueError(\"Hermes BASE_URL path must be /v1\")\n    if quote(decoded_path, safe=\"/\") != raw_path.rstrip(\"/\") and raw_path not in {\"/v1\", \"/v1/\"}:\n        raise ValueError(\"Hermes BASE_URL path must not contain encoded segments\")\n\n    hostname = parsed.hostname.strip().lower()\n    if hostname == \"localhost\":\n        hostname = \"127.0.0.1\"\n    elif hostname not in {\"127.0.0.1\", \"::1\"}:\n        raise ValueError(\"Hermes BASE_URL must point to 127.0.0.1, localhost, or [::1]\")\n\n    try:\n        port = parsed.port","sourceCodeStart":155,"sourceCodeEnd":191,"githubUrl":"https://github.com/ZhuLinsen/daily_stock_analysis/blob/5159bd72e8373d215492dff122acc9d389e219c9/src/llm/hermes.py#L155-L191","documentation":"Security check in canonicalize_hermes_base_url: the URL must not carry userinfo (user:password@ before the host). Credentials in the URL would leak into logs and are meaningless for a loopback-only bridge, so their presence is treated as a hard misconfiguration rather than ignored.","triggerScenarios":"BASE_URL like 'http://user:pass@127.0.0.1:8642/v1' or 'http://token@localhost:8642/v1' — urlparse.username/password are non-None and the guard fires.","commonSituations":"Pasting a cloud-provider endpoint style (common for OpenAI-compatible gateways that accept key@host) into Hermes config; habit from configuring other LLM base URLs that embed API keys.","solutions":["Remove userinfo from the URL; supply credentials through the dedicated key/config channel instead (devkey/registry), never in the URL.","Use plain 'http://127.0.0.1:8642/v1'."],"exampleFix":"# before\nBASE_URL=http://sk-secret@127.0.0.1:8642/v1\n\n# after\nBASE_URL=http://127.0.0.1:8642/v1","handlingStrategy":"validation","validationCode":"parsed = urlparse(base_url)\nassert not (parsed.username or parsed.password), \"remove userinfo from BASE_URL\"","typeGuard":"def url_without_userinfo(value: str) -> bool:\n    p = urlparse(value)\n    return p.username is None and p.password is None","tryCatchPattern":"try:\n    url = canonicalize_hermes_base_url(cfg.base_url)\nexcept ValueError as exc:\n    raise ConfigError(str(exc)) from exc","preventionTips":["Never embed credentials in URLs; use the dedicated secret channel (devkey)","Treat userinfo-in-URL as a secret leak even when the host is loopback"],"tags":["hermes","llm","config","security","url-validation"],"backgroundTag":null,"analyzedSha":"5159bd72e8373d215492dff122acc9d389e219c9","analyzedAt":"2026-08-15T01:59:36.292Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}