administrator/frigate
1
0
Fork 0
mirror of https://github.com/blakeblackshear/frigate.git synced 2026-10-20 05:32:49 +03:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

mask passwords that start with digits

Browse Source 
The port check in the userinfo pattern also matched passwords, so rtsp://admin:2024/pw@host and rtsp://admin:12#abc@host went out unmasked where the old regex masked them. The check is gone. Stopping at the next "://" already keeps the comma between two ffprobe paths, and a host:port/path@x is over-masked for display only, since saves restore it by value.
This commit is contained in:
Josh Hawkins
2026-10-18 14:41:28 -05:00
parent 31a18d8771
commit 7c49650575
3 changed files with 7 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frigate/const.py
+2 -6
View File
@@ -118,12 +118,8 @@ SUPPORTED_RK_SOCS = ["rk3562", "rk3566", "rk3568", "rk3576", "rk3588"]
REGEX_CAMERA_NAME = r"^[a-zA-Z0-9_-]+$"
REGEX_RTSP_CAMERA_USER_PASS = r":\/\/[a-zA-Z0-9_-]+:[\S]+@"
# A "user:" userinfo may hold "/", "#" or "@" in the password, so it runs to the
# last "@" before the next URL. A port after the colon is rejected so a bare
# host:port/path@x is not taken for credentials. Anything else stops at the
# authority end.
REGEX_URL_USERINFO = (
r"://(?:[^\s/?#:\[\]]*:(?!\d+(?:[/?#,\s]|$))(?:(?!://)\S)*|[^\s/?#]+)@"
)
# last "@" before the next URL. Anything else stops at the authority end.
REGEX_URL_USERINFO = r"://(?:[^\s/?#:\[\]]*:(?:(?!://)\S)*|[^\s/?#]+)@"
_CREDENTIAL_QUERY_KEYS = (
r"(?:user(?:name)?|usr|login|pass(?:word|wd)?|pwd"
r"|(?:[a-z_]*_)?token|(?:[a-z_]*_)?secret|client_private|api_?key)"
frigate/test/test_camera_pw.py
+4 -2
View File
@@ -60,6 +60,10 @@ class TestUserPassMasking(unittest.TestCase):
"rtsp://u:p@ss@10.0.0.2/live": "rtsp://*:*@10.0.0.2/live",
"rtsp://user:pa/ss@10.0.0.2/live": "rtsp://*:*@10.0.0.2/live",
"rtsp://u:p@ss#x@10.0.0.2/live": "rtsp://*:*@10.0.0.2/live",
"rtsp://admin:2024/pw@10.0.0.2/x": "rtsp://*:*@10.0.0.2/x",
"rtsp://admin:12#abc@10.0.0.2/x": "rtsp://*:*@10.0.0.2/x",
"rtsp://admin:7?x@10.0.0.2/x": "rtsp://*:*@10.0.0.2/x",
"rtsps://u:1/2@h/x": "rtsps://*:*@h/x",
"http://h/x?api_key=a&apikey=b&access_token=c": (
"http://h/x?api_key=*&apikey=*&access_token=*"
),
@@ -100,8 +104,6 @@ class TestUserPassMasking(unittest.TestCase):
"ffmpeg:front_door#video=copy",
"rtsp://127.0.0.1:8554/front_door?video=copy&audio=aac",
"homekit://10.0.0.2:51827?device_id=d",
"rtsp://10.0.0.1:554/live?x=a@b",
"rtsp://10.0.0.1:554/path@thing",
"http://10.0.0.1/snap.jpg?email=me@x.com",
"http://h/x?auth=a&author=b&authorization=c&user_agent=d&autoken=e",
"http://h/x?private=1&passthrough=1",
web/src/utils/credentialMask.ts
+1 -1
View File
@@ -2,7 +2,7 @@
const CREDENTIAL_QUERY_KEYS =
"(?:user(?:name)?|usr|login|pass(?:word|wd)?|pwd|(?:[a-z_]*_)?token|(?:[a-z_]*_)?secret|client_private|api_?key)";
const URL_USERINFO_PATTERN =
/:\/\/(?:[^\s/?#:[\]]*:(?!\d+(?:[/?#,\s]|$))(?:(?!:\/\/)\S)*|[^\s/?#]+)@/g;
/:\/\/(?:[^\s/?#:[\]]*:(?:(?!:\/\/)\S)*|[^\s/?#]+)@/g;
const CREDENTIAL_QUERY_PATTERN = new RegExp(
`([?&]${CREDENTIAL_QUERY_KEYS}=)[^&\\s]*`,
"gi",