mask passwords that start with digits

The port check in the userinfo pattern also matched passwords, so rtsp://admin:2024/pw@host and rtsp://admin:12#abc@host went out unmasked where the old regex masked them. The check is gone. Stopping at the next "://" already keeps the comma between two ffprobe paths, and a host:port/path@x is over-masked for display only, since saves restore it by value.

frigate/const.py

@@ -118,12 +118,8 @@ SUPPORTED_RK_SOCS = ["rk3562", "rk3566", "rk3568", "rk3576", "rk3588"]
 REGEX_CAMERA_NAME = r"^[a-zA-Z0-9_-]+$"
 REGEX_RTSP_CAMERA_USER_PASS = r":\/\/[a-zA-Z0-9_-]+:[\S]+@"
 # A "user:" userinfo may hold "/", "#" or "@" in the password, so it runs to the
-# last "@" before the next URL. A port after the colon is rejected so a bare
+# last "@" before the next URL. Anything else stops at the authority end.
-# host:port/path@x is not taken for credentials. Anything else stops at the
+REGEX_URL_USERINFO = r"://(?:[^\s/?#:\[\]]*:(?:(?!://)\S)*|[^\s/?#]+)@"
-# authority end.
-REGEX_URL_USERINFO = (
-    r"://(?:[^\s/?#:\[\]]*:(?!\d+(?:[/?#,\s]|$))(?:(?!://)\S)*|[^\s/?#]+)@"
-)
 _CREDENTIAL_QUERY_KEYS = (
     r"(?:user(?:name)?|usr|login|pass(?:word|wd)?|pwd"
     r"|(?:[a-z_]*_)?token|(?:[a-z_]*_)?secret|client_private|api_?key)"

frigate/test/test_camera_pw.py

@@ -60,6 +60,10 @@ class TestUserPassMasking(unittest.TestCase):
             "rtsp://u:p@ss@10.0.0.2/live": "rtsp://*:*@10.0.0.2/live",
             "rtsp://user:pa/ss@10.0.0.2/live": "rtsp://*:*@10.0.0.2/live",
             "rtsp://u:p@ss#x@10.0.0.2/live": "rtsp://*:*@10.0.0.2/live",
+            "rtsp://admin:2024/pw@10.0.0.2/x": "rtsp://*:*@10.0.0.2/x",
+            "rtsp://admin:12#abc@10.0.0.2/x": "rtsp://*:*@10.0.0.2/x",
+            "rtsp://admin:7?x@10.0.0.2/x": "rtsp://*:*@10.0.0.2/x",
+            "rtsps://u:1/2@h/x": "rtsps://*:*@h/x",
             "http://h/x?api_key=a&apikey=b&access_token=c": (
                 "http://h/x?api_key=*&apikey=*&access_token=*"
             ),
@@ -100,8 +104,6 @@ class TestUserPassMasking(unittest.TestCase):
             "ffmpeg:front_door#video=copy",
             "rtsp://127.0.0.1:8554/front_door?video=copy&audio=aac",
             "homekit://10.0.0.2:51827?device_id=d",
-            "rtsp://10.0.0.1:554/live?x=a@b",
-            "rtsp://10.0.0.1:554/path@thing",
             "http://10.0.0.1/snap.jpg?email=me@x.com",
             "http://h/x?auth=a&author=b&authorization=c&user_agent=d&autoken=e",
             "http://h/x?private=1&passthrough=1",

web/src/utils/credentialMask.ts

@@ -2,7 +2,7 @@
 const CREDENTIAL_QUERY_KEYS =
   "(?:user(?:name)?|usr|login|pass(?:word|wd)?|pwd|(?:[a-z_]*_)?token|(?:[a-z_]*_)?secret|client_private|api_?key)";
 const URL_USERINFO_PATTERN =
-  /:\/\/(?:[^\s/?#:[\]]*:(?!\d+(?:[/?#,\s]|$))(?:(?!:\/\/)\S)*|[^\s/?#]+)@/g;
+  /:\/\/(?:[^\s/?#:[\]]*:(?:(?!:\/\/)\S)*|[^\s/?#]+)@/g;
 const CREDENTIAL_QUERY_PATTERN = new RegExp(
   `([?&]${CREDENTIAL_QUERY_KEYS}=)[^&\\s]*`,
   "gi",