Normalize request paths in media auth (#24662)

* merge repeated slashes in the media auth path check

X-Original-URL carries only the raw request path since #24602, and extract_path parsed it with urlparse, which reads a path starting with // as a host. A restricted role could request another camera's clips or recordings with a leading // and the media check saw a non-media path and allowed it, while nginx merged the slashes and served the file. extract_path now splits the raw URI the same way the go2rtc stream check does and merges repeated slashes as nginx does before matching locations. The split helper moves from auth.py into media_auth.py so both checks share it.

* check the nginx-normalized path in the media auth dot-segment fallback

The dot-segment fallback only checked the raw first segment, so a role restricted to one camera could request `/x/../clips/back_door-1.jpg` and nginx served back_door's clip. The fallback now resolves the path the way nginx does before checking for a media root, and the URI split ends at a literal `#` since nginx ignores everything after it.

frigate/api/media_auth.py

@@ -13,8 +13,9 @@ from __future__ import annotations
 
 import logging
 import os
+import re
 from enum import Enum
-from urllib.parse import unquote, urlparse
+from urllib.parse import unquote
 
 from peewee import DoesNotExist
 
@@ -24,6 +25,8 @@ from frigate.models import Export, User
 
 logger = logging.getLogger(__name__)
 
+_URI_SCHEME_AND_AUTHORITY = re.compile(r"^[A-Za-z][A-Za-z0-9+.-]*://[^/?]*")
+
 
 class MediaAuthResolution(str, Enum):
     """Classification of an `X-Original-URL` path for media-auth purposes."""
@@ -41,6 +44,36 @@ class MediaAuthResolution(str, Enum):
     UNKNOWN = "unknown"
 
 
+def split_request_uri(request_uri: str) -> tuple[str, str]:
+    """Split a raw request URI into its path and query string.
+
+    urlparse is not used since it reads a path starting with `//` as a host.
+    nginx ends the URI at a literal `#`, so anything after it is dropped.
+    """
+    uri = _URI_SCHEME_AND_AUTHORITY.sub("", request_uri, count=1)
+    path, _, query = uri.partition("#")[0].partition("?")
+    return path, query
+
+
+def normalize_request_path(path: str) -> str:
+    """Normalize a raw request path the way nginx does before matching locations.
+
+    nginx percent-decodes the path, merges repeated slashes and resolves dot
+    segments, while `X-Original-URL` carries the raw `$request_uri`.
+    """
+    segments: list[str] = []
+    for segment in unquote(path).split("/"):
+        if segment in ("", "."):
+            continue
+        if segment == "..":
+            if segments:
+                segments.pop()
+            continue
+        segments.append(segment)
+
+    return "/" + "/".join(segments)
+
+
 def extract_path(original_url: str | None) -> str | None:
     """Return the decoded path component of nginx's `X-Original-URL` header.
 
@@ -49,14 +82,14 @@ def extract_path(original_url: str | None) -> str | None:
     request like `/recordings/.../allowed_cam/../forbidden_cam/file.mp4`
     would (1) parse as the allowed camera in our auth check, (2) be served
     as the forbidden camera by nginx. To close the bypass we reject any URI
-    whose path contains `.` or `..` segments outright.
+    whose path contains `.` or `..` segments outright. Repeated slashes are
+    merged, as nginx does before matching locations.
     """
     if not original_url:
         return None
 
-    parsed = urlparse(original_url)
-    raw_path = parsed.path or original_url
-    decoded = unquote(raw_path)
+    path, _ = split_request_uri(original_url)
+    decoded = re.sub(r"/{2,}", "/", unquote(path))
     if not decoded:
         return None
 
@@ -252,12 +285,11 @@ def deny_response_for_media_uri(
     path = extract_path(original_url)
 
     # `extract_path` returns None for URIs containing `.` or `..` segments.
-    # For media-root URIs that's a traversal attempt — deny outright. For
-    # non-media URIs, pass through (nginx / the backend handle them).
+    # Deny them when nginx would resolve them under a media root, and pass
+    # the rest through to nginx and the backend.
     if path is None:
-        raw = urlparse(original_url).path or original_url
-        decoded = unquote(raw)
-        first = decoded.lstrip("/").split("/", 1)[0] if decoded else ""
+        normalized = normalize_request_path(split_request_uri(original_url)[0])
+        first = normalized.lstrip("/").split("/", 1)[0]
         if first in ("clips", "recordings", "exports"):
             return 403
         return None