hermes - 💡(How to fix) Fix WhatsApp setup: WHATSAPP_ALLOWED_USERS should be mandatory [1 participants]

TL;DR

To address the security vulnerability, update the allowlist.js to deny access by default when the allowlist is empty and implement additional measures such as refusing to start the WhatsApp bridge if WHATSAPP_ALLOWED_USERS is not set.

Guidance

• Review and modify the allowlist.js file to change the behavior for an empty allowlist from return true to return false to deny access by default.
• Consider implementing a check to refuse starting the WhatsApp bridge if the WHATSAPP_ALLOWED_USERS environment variable is not set.
• Enhance the hermes gateway setup for WhatsApp to require user input for their phone number and auto-populate WHATSAPP_ALLOWED_USERS for easier configuration.
• Add logging to warn prominently when the bridge starts without an allowlist configured.

Example

if (!allowedUsers || allowedUsers.size === 0) {
    return false; // EMPTY ALLOWLIST = DENY EVERYONE
}

Notes

The proposed fix involves multiple steps to enhance security, including code changes and setup modifications. It's crucial to test these changes thoroughly to ensure they do not introduce unintended behavior.

Recommendation

Apply the workaround by updating the allowlist.js and implementing the proposed fixes to enhance security and access control. This approach directly addresses the identified vulnerability and improves the overall security posture of the WhatsApp bridge setup.