administrator/frigate
1
0
Fork 0
mirror of https://github.com/blakeblackshear/frigate.git synced 2026-10-19 21:22:50 +03:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

bound the credential mask to the url authority

Browse Source 
The userinfo pattern ran from any host:port to the last "@" in the token, so rtsp://host:554/live?x=a@b lost its host and a comma between two URLs was swallowed, which merged the paths /ffprobe splits on. It also backtracked quadratically on long lines with many "://", and every subprocess log line goes through it. A "user:" userinfo now runs to the last "@" before the next URL unless a port follows the colon, and any other userinfo stops at the end of the authority. Query masking now covers only real secret names, so auth, private and autoken are left alone.
This commit is contained in:
Josh Hawkins
2026-10-18 14:41:28 -05:00
parent daed9ebeb3
commit c90e00061a
3 changed files with 35 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
web/src/utils/credentialMask.ts
+3 -2
View File
@@ -1,7 +1,8 @@
// Mirrors clean_camera_user_pass and REGEX_MASKED_CREDENTIAL in the backend.
const CREDENTIAL_QUERY_KEYS =
"(?:user(?:name)?|usr|login|pass(?:word|wd)?|pwd|[a-z_]*token|[a-z_]*secret|[a-z_]*private|api_?key|auth)";
const URL_USERINFO_PATTERN = /:\/\/(?:[^\s/:]*:\S*|[^\s/]+)@/g;
"(?:user(?:name)?|usr|login|pass(?:word|wd)?|pwd|(?:[a-z_]*_)?token|(?:[a-z_]*_)?secret|client_private|api_?key)";
const URL_USERINFO_PATTERN =
/:\/\/(?:[^\s/?#:[\]]*:(?!\d+(?:[/?#,\s]|$))(?:(?!:\/\/)\S)*|[^\s/?#]+)@/g;
const CREDENTIAL_QUERY_PATTERN = new RegExp(
`([?&]${CREDENTIAL_QUERY_KEYS}=)[^&\\s]*`,
"gi",