go2rtc expands ${NAME:default} over the raw config text before parsing it, and falls back to the inline default when NAME is unset, so a stream source like ${NOPE:exec:<cmd>} passed the exec gate and go2rtc then ran the command. On master the API accepted the plain form, and startup accepted the ${{...}} form because .format collapsed it to ${...} after the check would have caught it. Any stream source containing ${ is now restricted unless GO2RTC_ALLOW_ARBITRARY_EXEC is set, the same as exec sources.
* restrict go2rtc ffmpeg and ngrok options without arbitrary exec
The GO2RTC_ALLOW_ARBITRARY_EXEC checks only looked at go2rtc.streams, so an admin could save a config with a custom ffmpeg.bin or ngrok.command and run any command as the go2rtc user after a restart. go2rtc builds every ffmpeg: source into a command that starts with ffmpeg.bin, and it runs ngrok.command at startup. A custom template also brought back arbitrary ffmpeg arguments, since a stream can reference any template key with #video=<name>.
config/save and config/set now reject any added or changed key under go2rtc.ffmpeg or go2rtc.ngrok unless arbitrary exec is enabled. Keys already in the saved config are left alone, the same as stream sources. At startup, ffmpeg.bin is always Frigate's ffmpeg and ngrok is dropped unless arbitrary exec is enabled. Templates already in the config file, such as the documented vaapi global, keep working.
* reject ffmpeg paths with spaces, quotes or shell characters
ffmpeg.path was used as-is when absolute, and several ffmpeg commands are built as strings and split on spaces before running. A path like `/bin/sh -c <cmd>;#` ran a shell command instead of ffmpeg in the preview and export processes, and in go2rtc through the birdseye restream exec source. The path is now validated as a version alias or an absolute path of plain characters, so config/save and config/set reject an unsafe value. resolve_ffmpeg_path falls back to the default ffmpeg for one, and the go2rtc startup script prints an error.
* update version
* Restrict ffmpeg: go2rtc sources added through the API
go2rtc expands ffmpeg: sources into an exec: command line built from the
source's #key=value parameters, so the echo/expr/exec prefix check on
PUT /go2rtc/streams could be bypassed to run arbitrary ffmpeg arguments.
Sources submitted through the API now only accept the ffmpeg: parameters
the UI and docs use (video, audio, hardware with preset names, plus
numeric width/height/rotate/bitrate/timeout and async). Quotes,
whitespace, #raw, #input, #drawtext and unknown parameters are rejected
unless GO2RTC_ALLOW_ARBITRARY_EXEC is set. Sources defined in the config
file are unchanged.
Fixes GHSA-qjjw-3v66-279f
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Only allow existing streams on proxied go2rtc live paths
nginx proxies /live/mse/api/ws, /live/webrtc/api/ws and /api/go2rtc/webrtc
straight to go2rtc, which creates a new ad hoc stream from any src that is
not an existing stream name and starts the producer it describes. Any
authenticated user, including the built-in viewer role, could use this to
launch arbitrary go2rtc sources without going through the restricted-source
checks on PUT /go2rtc/streams.
The /auth subrequest now denies these paths unless every src names an
existing stream: a camera or its live stream, a go2rtc stream from the
config, or a stream go2rtc reports at runtime. This applies to every role,
and the runtime lookup fails closed when go2rtc cannot be reached.
Fixes GHSA-93xj-hg88-ffg7
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Ignore GO2RTC_ALLOW_ARBITRARY_EXEC in environment_vars
environment_vars installs every key into the Frigate process environment
at startup, so an admin could enable GO2RTC_ALLOW_ARBITRARY_EXEC from the
config and turn off the restricted go2rtc source checks on the API. The
override is meant to be set by the operator in the container environment
(or the Home Assistant add-on options), so it is now skipped with a
warning when it appears in environment_vars.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Apply go2rtc source restrictions to config/save and config/set
go2rtc.streams written through config/save or config/set were only
filtered at startup, which blocks echo/expr/exec and the map form but not
the ffmpeg: parameters that PUT /go2rtc/streams now rejects. Saving a
stream this way and restarting bypassed the API restriction.
Both endpoints now reject a change that adds a go2rtc stream source that
fails is_restricted_go2rtc_api_source, or a map-form source, unless
GO2RTC_ALLOW_ARBITRARY_EXEC is set. Sources already in the saved config
for the same stream are left alone, so streams configured on disk keep
working and resubmitting the whole file from the config editor succeeds.
config/set restores the previous file when it rejects a change.
Follow-up to GHSA-qjjw-3v66-279f
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Match go2rtc stream-proxy paths the way nginx does
/auth compared the raw $request_uri path against the three go2rtc
stream-proxy paths exactly, while nginx matches its prefix locations
against the normalized URI. Encoded characters, repeated slashes, dot
segments or a suffix on the path skipped the stream check even though
nginx still proxied the request to go2rtc.
The go2rtc stream locations now set a variable that the auth subrequest
forwards as X-Go2rtc-Stream-Proxy (client headers are not forwarded, so it
cannot be spoofed). As a fallback, /auth also normalizes the path like
nginx (percent-decoding, merging slashes, resolving dot segments) and
prefix matches it, and splits the raw URI by hand since urlparse reads a
leading // as a host.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Parse config stream changes with Frigate's YAML loader
The go2rtc stream check on config/save and config/set parsed the config
with the safe loader and treated a parse error as an empty config, while
Frigate and the go2rtc startup script use the round-trip loader. Input
that only the round-trip loader accepts, such as a tagged root map, hid
new stream sources from the check.
The check now uses the same round-trip loader and rejects the request
when the new config cannot be parsed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Resolve go2rtc stream placeholders the same way everywhere
The go2rtc startup script expanded stream sources with str.format(),
which also supports attribute and index access, while the config API
check used substitute_frigate_vars and fell back to the raw string when a
placeholder could not be resolved. A placeholder the API check could not
resolve could therefore expand into a restricted source at startup.
The startup script now uses substitute_frigate_vars, like the rest of the
config, and the API check rejects a stream source whose placeholders
cannot be resolved. The startup script's own copy of the FRIGATE_* env
var map is removed; the shared one also honors CREDENTIALS_DIRECTORY.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Accept codec sample rates in ffmpeg: go2rtc sources
The ffmpeg: parameter allowlist only accepted plain names for video,
audio and hardware, so the documented HomeKit source with
#audio=opus/16000 was rejected by PUT /go2rtc/streams, config/save and
config/set. Names may now carry a numeric /rate suffix. A rate without a
name is still rejected. All ffmpeg: sources in the docs pass the check.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Restore the environment after go2rtc exec override tests
Tests that removed or set GO2RTC_ALLOW_ARBITRARY_EXEC did not restore a
value that was already present, so later tests could run with a changed
security setting. They now use patch.dict on os.environ.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Revert the go2rtc startup script to str.format substitution
Restores create_config.py to its state on master. The config API check
rejects any stream source whose {FRIGATE_*} placeholders it cannot
resolve with substitute_frigate_vars, and for every source it accepts,
str.format() at startup either produces the same string or fails and
stops go2rtc startup. Changing the startup script is therefore not
needed for the fix, and leaving it alone avoids a conflict with dev,
which already moved this script to the new env helpers.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Explain why a go2rtc stream change was rejected
A stream source with an undefined or malformed {FRIGATE_*} placeholder
was reported as a restricted source, which reads like a security block
when the user made a typo. The config API now reports unknown variables
and invalid placeholders separately from restricted sources.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The i915 driver never publishes per-client usage counters on GPUs older than Broadwell, so Haswell and older users got a warning telling them to upgrade to kernel 6.5 even on 6.12. The warning and docs now state the Broadwell requirement alongside the kernel 6.5 requirement for 12th gen and newer.
* Pin ruff
* Add python upgrade fixes
This enables python upgrade checks in ruff to look for deprecated types and patterns. This namely fixes:
- usage of deprecated `Typing` which is now built in
- some specific exceptions which are caught and have new aliases
Some specific UP checks were also ignored as they are stylistic / unimportant and likely to cause bugs
* Remove async blocking calls
Use asyncio.to_thread on two remaining blocking calls to fix hanging event thread loop. Enable this specific rule to block it in the future.
* Use proper logging mechanism
* Correctly format logs
* Raise with context
When raising an exception include the from context to improve debugging
* Cleanup
Resolve conflicts in the export pipeline where dev's job-queue refactor
met master's chapter-metadata and security work.
- Unify chapter support under ChaptersEnum (none / recording_segments /
review_items); the realtime stream-copy export selects the per-segment
or per-review-item builder by the camera's configured mode. Thread
chapters through ExportRecordingsBody -> _build_export_job -> ExportJob
-> RecordingExporter.
- Keep master's creation_time/comment export metadata and fix a
video_path duplication the textual merge introduced in the preview
command.
- Move the chapters request field to ExportRecordingsBody (the single
export endpoint) where it is actually honored.
Restore security fixes the automatic merge would have reverted:
- frigate/util/services.py: restore the #23493 rename to the public
is_go2rtc_arbitrary_exec_allowed so create_config.py's dynamic-source
exec guard imports and runs (the merge otherwise left a broken import).
- Preserve the export image-path ".." traversal check inside
_sanitize_existing_image, applied to single/custom/batch exports.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* resolve global record.export.hwaccel_args to fix phantom camera override
* auto-stop debug replay sessions after 12 hours
* docs tweaks
* add more tips to object classification docs
* tweak language
* Store hwaccel errors with timeout so it can retry
* Add error logs for Intel GPU stats
* add area
---------
Co-authored-by: Nicolas Mowen <nickmowen213@gmail.com>
* filter motion review by allowed cameras
* filter alertCameras by allowed cameras so the recent alerts query for restricted roles doesn't reference cameras they can't access
* skip data streams in chapter exports to avoid ffmpeg segfault
* formatting
* restrict debug replay UI entry points to admin users
* Adjust default iGPU name when it can't be found
* Fix when model tries to request an invalid camera
* Improve prompt
* add collapsible main nav items in settings
---------
Co-authored-by: Nicolas Mowen <nickmowen213@gmail.com>
* use stable empty object reference for swr metadata default
* version bump
* Refactor get_min_region_size for dimension normalization
Refactor get_min_region_size to normalize dimensions for smaller models and ensure minimum region size is 320 for larger models.
* reject restricted go2rtc stream sources when added via api
* add env var check function
* fix typing
---------
Co-authored-by: Nicolas Mowen <nickmowen213@gmail.com>
* sync filter entries with track and listen labels
- Auto-populate `audio.filters` from `audio.listen` instead of the full audio labelmap, matching how `objects.filters` is keyed by `track` (no longer need to populate the full audio labelmap, which was added in #22630)
- Synthesize the matching filter entries in the settings form on load so each track/listen label shows its collapsible after a profile is selected, since the backend's auto-populate only runs at config init
* translate main label for lifecycle description with attribute
* reject restricted go2rtc stream sources when added via api
* add env var check function
* Rewrite intel GPU stats to use file descriptors instead of intel_gpu_top, leading to significantly better API for interaction and more accurate results
* Update tests
* Update docs
* Adjust approach
* Update strings
* use ffmpeg to probe rtsp urls instead of cv2
cv2 is faster (no subprocess launch) and will continue to be used for recording segments
* tweak faq
* change unsaved color to orange
avoids confusion with validation errors (red)
* don't use any variant of orange as a profile color
avoids confusion with unsaved changes
* more unsaved color tweaks
asyncio.SubprocessError does not exist — Python's asyncio module has no
such class. The correct exception is subprocess.SubprocessError, which
is available via the existing `import subprocess as sp` alias already
present in this file.
The invalid exception reference causes the except clause to raise a
NameError rather than catching the intended exception.
The psutil library reads the process commandline as by opening
/proc/pid/cmdline which returns a buffer that is larger than just the
program cmdline due to rounded memory allocation sizes.
That means that if the library does not detect a Null-terminated string
it keeps appending empty strings which add up as whitespaces when joined.
* Add rockchip temps
* Add support for GPU and NPU temperatures in the frontend
* Add support for Nvidia temperature
* Improve separation
* Adjust graph scaling
* Add Hailo temperature retrieval
* Refactor `get_hailo_temps()` to use ctxmanager
* Show Hailo temps in system UI
* Move hailo_platform import to get_hailo_temps
* Refactor temperatures calculations to use within detector block
* Adjust webUI to handle new location
---------
Co-authored-by: tigattack <10629864+tigattack@users.noreply.github.com>
* Update version
* Create scaffolding for case management (#21293)
* implement case management for export apis (#21295)
* refactor vainfo to search for first GPU (#21296)
use existing LibvaGpuSelector to pick appropritate libva device
* Case management UI (#21299)
* Refactor export cards to match existing cards in other UI pages
* Show cases separately from exports
* Add proper filtering and display of cases
* Add ability to edit and select cases for exports
* Cleanup typing
* Hide if no unassigned
* Cleanup hiding logic
* fix scrolling
* Improve layout
* Camera connection quality indicator (#21297)
* add camera connection quality metrics and indicator
* formatting
* move stall calcs to watchdog
* clean up
* change watchdog to 1s and separately track time for ffmpeg retry_interval
* implement status caching to reduce message volume
* Export filter UI (#21322)
* Get started on export filters
* implement basic filter
* Implement filtering and adjust api
* Improve filter handling
* Improve navigation
* Cleanup
* handle scrolling
* Refactor temperature reporting for detectors and implement Hailo temp reading (#21395)
* Add Hailo temperature retrieval
* Refactor `get_hailo_temps()` to use ctxmanager
* Show Hailo temps in system UI
* Move hailo_platform import to get_hailo_temps
* Refactor temperatures calculations to use within detector block
* Adjust webUI to handle new location
---------
Co-authored-by: tigattack <10629864+tigattack@users.noreply.github.com>
* Camera-specific hwaccel settings for timelapse exports (correct base) (#21386)
* added hwaccel_args to camera.record.export config struct
* populate camera.record.export.hwaccel_args with a cascade up to camera then global if 'auto'
* use new hwaccel args in export
* added documentation for camera-specific hwaccel export
* fix c/p error
* missed an import
* fleshed out the docs and comments a bit
* ruff lint
* separated out the tips in the doc
* fix documentation
* fix and simplify reference config doc
* Add support for GPU and NPU temperatures (#21495)
* Add rockchip temps
* Add support for GPU and NPU temperatures in the frontend
* Add support for Nvidia temperature
* Improve separation
* Adjust graph scaling
* Exports Improvements (#21521)
* Add images to case folder view
* Add ability to select case in export dialog
* Add to mobile review too
* Add API to handle deleting recordings (#21520)
* Add recording delete API
* Re-organize recordings apis
* Fix import
* Consolidate query types
* Add media sync API endpoint (#21526)
* add media cleanup functions
* add endpoint
* remove scheduled sync recordings from cleanup
* move to utils dir
* tweak import
* remove sync_recordings and add config migrator
* remove sync_recordings
* docs
* remove key
* clean up docs
* docs fix
* docs tweak
* Media sync API refactor and UI (#21542)
* generic job infrastructure
* types and dispatcher changes for jobs
* save data in memory only for completed jobs
* implement media sync job and endpoints
* change logs to debug
* websocket hook and types
* frontend
* i18n
* docs tweaks
* endpoint descriptions
* tweak docs
* use same logging pattern in sync_recordings as the other sync functions (#21625)
* Fix incorrect counting in sync_recordings (#21626)
* Update go2rtc to v1.9.13 (#21648)
Co-authored-by: Eugeny Tulupov <eugeny.tulupov@spirent.com>
* Refactor Time-Lapse Export (#21668)
* refactor time lapse creation to be a separate API call with ability to pass arbitrary ffmpeg args
* Add CPU fallback
* Optimize empty directory cleanup for recordings (#21695)
The previous empty directory cleanup did a full recursive directory
walk, which can be extremely slow. This new implementation only removes
directories which have a chance of being empty due to a recent file
deletion.
* Implement llama.cpp GenAI Provider (#21690)
* Implement llama.cpp GenAI Provider
* Add docs
* Update links
* Fix broken mqtt links
* Fix more broken anchors
* Remove parents in remove_empty_directories (#21726)
The original implementation did a full directory tree walk to find and remove
empty directories, so this implementation should remove the parents as well,
like the original did.
* Implement LLM Chat API with tool calling support (#21731)
* Implement initial tools definiton APIs
* Add initial chat completion API with tool support
* Implement other providers
* Cleanup
* Offline preview image (#21752)
* use latest preview frame for latest image when camera is offline
* remove frame extraction logic
* tests
* frontend
* add description to api endpoint
* Update to ROCm 7.2.0 (#21753)
* Update to ROCm 7.2.0
* ROCm now works properly with JinaV1
* Arcface has compilation error
* Add live context tool to LLM (#21754)
* Add live context tool
* Improve handling of images in request
* Improve prompt caching
* Add networking options for configuring listening ports (#21779)
* feat: add X-Frame-Time when returning snapshot (#21932)
Co-authored-by: Florent MORICONI <170678386+fmcloudconsulting@users.noreply.github.com>
* Improve jsmpeg player websocket handling (#21943)
* improve jsmpeg player websocket handling
prevent websocket console messages from appearing when player is destroyed
* reformat files after ruff upgrade
* Allow API Events to be Detections or Alerts, depending on the Event Label (#21923)
* - API created events will be alerts OR detections, depending on the event label, defaulting to alerts
- Indefinite API events will extend the recording segment until those events are ended
- API event start time is the actual start time, instead of having a pre-buffer of record.event_pre_capture
* Instead of checking for indefinite events on a camera before deciding if we should end the segment, only update last_detection_time and last_alert_time if frame_time is greater, which should have the same effect
* Add the ability to set a pre_capture number of seconds when creating a manual event via the API. Default behavior unchanged
* Remove unnecessary _publish_segment_start() call
* Formatting
* handle last_alert_time or last_detection_time being None when checking them against the frame_time
* comment manual_info["label"].split(": ")[0] for clarity
* ffmpeg Preview Segment Optimization for "high" and "very_high" (#21996)
* Introduce qmax parameter for ffmpeg preview encoding
Added PREVIEW_QMAX_PARAM to control ffmpeg encoding quality.
* formatting
* Fix spacing in qmax parameters for preview quality
* Adapt to new Gemini format
* Fix frame time access
* Remove exceptions
* Cleanup
---------
Co-authored-by: Josh Hawkins <32435876+hawkeye217@users.noreply.github.com>
Co-authored-by: tigattack <10629864+tigattack@users.noreply.github.com>
Co-authored-by: Andrew Roberts <adroberts@gmail.com>
Co-authored-by: Eugeny Tulupov <zhekka3@gmail.com>
Co-authored-by: Eugeny Tulupov <eugeny.tulupov@spirent.com>
Co-authored-by: John Shaw <1753078+johnshaw@users.noreply.github.com>
Co-authored-by: Eric Work <work.eric@gmail.com>
Co-authored-by: FL42 <46161216+fl42@users.noreply.github.com>
Co-authored-by: Florent MORICONI <170678386+fmcloudconsulting@users.noreply.github.com>
Co-authored-by: nulledy <254504350+nulledy@users.noreply.github.com>
* Fix jetson stats reading
* Return result
* Avoid unknown class for cover image
* fix double encoding of passwords in camera wizard
* formatting
* empty homekit config fixes
* add locks to jina v1 embeddings
protect tokenizer and feature extractor in jina_v1_embedding with per-instance thread lock to avoid the "Already borrowed" RuntimeError during concurrent tokenization
* Capitalize correctly
* replace deprecated google-generativeai with google-genai
update gemini genai provider with new calls from SDK
provider_options specifies any http options
suppress unneeded info logging
* fix attribute area on detail stream hover
---------
Co-authored-by: Josh Hawkins <32435876+hawkeye217@users.noreply.github.com>
* fetch more from ffprobe
* add detailed param to ffprobe endpoint
* add dots variant to step indicator
* add classname
* tweak colors for dark mode to match figma
* add step 1 form
* add helper function for ffmpeg snapshot
* add go2rtc stream add and ffprobe snapshot endpoints
* add camera image and stream details on successful test
* step 1 tweaks
* step 2 and i18n
* types
* step 1 and 2 tweaks
* add wizard to camera settings view
* add data unit i18n keys
* restream tweak
* fix type
* implement rough idea for step 3
* add api endpoint to delete stream from go2rtc
* add main wizard dialog component
* extract logic for friendly_name and use in wizard
* add i18n and popover for brand url
* add camera name to top
* consolidate validation logic
* prevent dialog from closing when clicking outside
* center camera name on mobile
* add help/docs link popovers
* keep spaces in friendly name
* add stream details to overlay like stats in liveplayer
* add validation results pane to step 3
* ensure test is invalidated if stream is changed
* only display validation results and enable save button if all streams have been tested
* tweaks
* normalize camera name to lower case and improve hash generation
* move wizard to subfolder
* tweaks
* match look of camera edit form to wizard
* move wizard and edit form to its own component
* move enabled/disabled switch to management section
* clean up
* fixes
* fix mobile
* refactor get_video_properties and use json output from ffprobe
* add zmq topic
* publish valid segment data in recording maintainer
* check for valid video data
- restart separate record ffmpeg process if no video data has been received in 120s
- refactor datetime import
* listen to correct topic in embeddings maintainer
* refactor to move get_latest_segment_datetime logic to recordings maintainer
* debug logging
* cleanup
Not everyone is using /dev/dri/card0. I recommend switching to these more generic parameters for intel_gpu_top_command (line 307 in the 0.16.0-beta2 version of services.py):
intel_gpu_top_command += ["-d", "sriov"]
* Fix the `Any` typing hint treewide
There has been confusion between the Any type[1] and the any function[2]
in typing hints.
[1] https://docs.python.org/3/library/typing.html#typing.Any
[2] https://docs.python.org/3/library/functions.html#any
* Fix typing for various frame_shape members
Frame shapes are most likely defined by height and width, so a single int
cannot express that.
* Wrap gpu stats functions in Optional[]
These can return `None`, so they need to be `Type | None`, which is what
`Optional` expresses very nicely.
* Fix return type in get_latest_segment_datetime
Returns a datetime object, not an integer.
* Make the return type of FrameManager.write optional
This is necessary since the SharedMemoryFrameManager.write function can
return None.
* Fix total_seconds() return type in get_tz_modifiers
The function returns a float, not an int.
https://docs.python.org/3/library/datetime.html#datetime.timedelta.total_seconds
* Account for floating point results in to_relative_box
Because the function uses division the return types may either be int or
float.
* Resolve ruff deprecation warning
The config has been split into formatter and linter, and the global
options are deprecated.
* Add npu usages as a statistic
* Support showing NPU stats in dashboard
* Add sys volume mount for npu usages
* Fix type
* Simplify check
* Cleanup
* Cleanup
Josh Hawkins