Skip to content

fix: guard str.split() index access against empty results#2752

Closed
nidhi-singh02 wants to merge 1 commit into
NousResearch:mainfrom
nidhi-singh02:fix/unchecked-split-index-access
Closed

fix: guard str.split() index access against empty results#2752
nidhi-singh02 wants to merge 1 commit into
NousResearch:mainfrom
nidhi-singh02:fix/unchecked-split-index-access

Conversation

@nidhi-singh02

Copy link
Copy Markdown
Contributor

Summary

  • Guard linter_cmd.split()[0] in tools/file_operations.py against empty commands
  • Guard text.split()[0] in gateway/platforms/slack.py against whitespace-only messages
  • Guard result.stdout.strip().split()[0] in agent/anthropic_adapter.py against empty output

All three cases could raise IndexError when split() returns an empty list.

Closes #2745

Test Plan

  • Configure an empty linter command and verify graceful skip instead of crash
  • Send a whitespace-only Slack command and verify it falls through to /help
  • Verify Claude Code version detection handles empty stdout gracefully

Platforms Tested

  • macOS

Prevents IndexError when split() returns an empty list from
whitespace-only or empty strings in file_operations, slack
platform, and anthropic_adapter.
@alt-glitch alt-glitch added type/bug Something isn't working P3 Low — cosmetic, nice to have comp/cli CLI entry point, hermes_cli/, setup wizard comp/gateway Gateway runner, session dispatch, delivery platform/slack Slack app adapter labels May 3, 2026
teknium1 added a commit that referenced this pull request May 15, 2026
When a user sends a Slack message like '/hermes   ' (trailing whitespace
after the slash) the legacy subcommand router hit `text.split()[0]` with
a truthy-but-whitespace-only `text`. `'   '.split()` returns `[]` →
IndexError, blowing up the slash handler before fallthrough to `/help`.

Switch to a two-step guard that materializes the parts list first and
indexes only if non-empty.

Salvaged from PR #2752 by @nidhi-singh02. The PR's other two hunks
(`tools/file_operations.py`, `agent/anthropic_adapter.py`) are
unreachable in current code — `LINTERS` is a hardcoded constant dict
with no empty values, and the anthropic version-detection site is
already guarded by a `result.stdout.strip()` truthy check — so only the
slack hunk is taken.

Closes #2745

Co-authored-by: Teknium <127238744+teknium1@users.noreply.github.com>
@teknium1

Copy link
Copy Markdown
Contributor

Salvaged via #26245 with your slack hunk and authorship preserved (commit on main). The other two hunks (tools/file_operations.py, agent/anthropic_adapter.py) were dropped — both call sites are unreachable in current code:

  • tools/file_operations.py: LINTERS is a hardcoded constant dict with no empty values, so linter_cmd.split()[0] cannot raise IndexError.
  • agent/anthropic_adapter.py: already guarded one line above by if result.returncode == 0 and result.stdout.strip(): — a non-empty stripped string always splits to at least one token.

Thanks for the fix! The slack one was a real reachable bug.

@teknium1 teknium1 closed this May 15, 2026
DIZ-admin pushed a commit to DIZ-admin/hermes-agent that referenced this pull request May 16, 2026
When a user sends a Slack message like '/hermes   ' (trailing whitespace
after the slash) the legacy subcommand router hit `text.split()[0]` with
a truthy-but-whitespace-only `text`. `'   '.split()` returns `[]` →
IndexError, blowing up the slash handler before fallthrough to `/help`.

Switch to a two-step guard that materializes the parts list first and
indexes only if non-empty.

Salvaged from PR NousResearch#2752 by @nidhi-singh02. The PR's other two hunks
(`tools/file_operations.py`, `agent/anthropic_adapter.py`) are
unreachable in current code — `LINTERS` is a hardcoded constant dict
with no empty values, and the anthropic version-detection site is
already guarded by a `result.stdout.strip()` truthy check — so only the
slack hunk is taken.

Closes NousResearch#2745

Co-authored-by: Teknium <127238744+teknium1@users.noreply.github.com>
gweeteve pushed a commit to gweeteve/hermes-agent that referenced this pull request Jun 2, 2026
When a user sends a Slack message like '/hermes   ' (trailing whitespace
after the slash) the legacy subcommand router hit `text.split()[0]` with
a truthy-but-whitespace-only `text`. `'   '.split()` returns `[]` →
IndexError, blowing up the slash handler before fallthrough to `/help`.

Switch to a two-step guard that materializes the parts list first and
indexes only if non-empty.

Salvaged from PR NousResearch#2752 by @nidhi-singh02. The PR's other two hunks
(`tools/file_operations.py`, `agent/anthropic_adapter.py`) are
unreachable in current code — `LINTERS` is a hardcoded constant dict
with no empty values, and the anthropic version-detection site is
already guarded by a `result.stdout.strip()` truthy check — so only the
slack hunk is taken.

Closes NousResearch#2745

Co-authored-by: Teknium <127238744+teknium1@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

comp/cli CLI entry point, hermes_cli/, setup wizard comp/gateway Gateway runner, session dispatch, delivery P3 Low — cosmetic, nice to have platform/slack Slack app adapter type/bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: Unchecked str.split() index access can raise IndexError

3 participants