administrator/frigate
1
0
Fork 0
mirror of https://github.com/blakeblackshear/frigate.git synced 2026-10-20 05:32:49 +03:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

mask the whole url when userinfo and a query credential overlap

Browse Source 
Masking userinfo first leaked the tail of a query password holding "@" on URLs with a port, like rtsp://10.0.0.2:554/live?password=pre@suf. When the userinfo span contains a credential query key, the mask now covers the rest of the URL in both clean_camera_user_pass and maskCredentials.
This commit is contained in:
Josh Hawkins
2026-10-18 14:41:28 -05:00
parent 03e5ab9d1f
commit 1b1ee3d7c9
4 changed files with 35 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
web/src/utils/credentialMask.ts
+10 -2
View File
@@ -2,7 +2,11 @@
const CREDENTIAL_QUERY_KEYS =
"(?:user(?:name)?|usr|login|pass(?:word|wd)?|pwd|(?:[a-z_]*_)?token|(?:[a-z_]*_)?secret|client_private|api_?key)";
const URL_USERINFO_PATTERN =
/:\/\/(?:[^\s/?#:[\]]*:(?:(?!:\/\/)\S)*|[^\s/?#]+)@/g;
/:\/\/((?:[^\s/?#:[\]]*:(?:(?!:\/\/)\S)*|[^\s/?#]+))@((?:(?!:\/\/)\S)*)/g;
const CREDENTIAL_QUERY_KEY_PATTERN = new RegExp(
`[?&]${CREDENTIAL_QUERY_KEYS}=`,
"i",
);
const CREDENTIAL_QUERY_PATTERN = new RegExp(
`([?&]${CREDENTIAL_QUERY_KEYS}=)[^&\\s]*`,
"gi",
@@ -21,7 +25,11 @@ export const maskCredentials = (value: string): string => {
}
return value
.replace(URL_USERINFO_PATTERN, "://*:*@")
.replace(URL_USERINFO_PATTERN, (_match, userinfo: string, rest: string) =>
CREDENTIAL_QUERY_KEY_PATTERN.test(userinfo)
? "://*:*@"
: `://*:*@${rest}`,
)
.replace(CREDENTIAL_QUERY_PATTERN, "$1*");
};