Josh HawkinsandGitHub 11f8786459 sanitize user-supplied path components (#23990) ...

sanitize_filename leaves ".." intact and collapses variants like "..:" and "..*" to "..", so filesystem paths built from face names, classification model/category names, image ids, and trigger data could escape their base directory. Route every such site through new frigate/util/path.py helpers (safe_join, sanitize_path_component, sanitize_contained_path), which reject traversal and verify containment.

Worst case was DELETE /classification/{name}, which rmtree'd /media/frigate and /config while returning 200.

Important to note that all affected endpoints already require admin permission, so this sould be considered hardening rather than fixing exploitable code.

2026-08-13 21:59:46 -05:00

..

http_api

sanitize user-supplied path components (#23990)

2026-08-13 21:59:46 -05:00

__init__.py

app container and config schema

2021-01-26 21:40:33 -06:00

const.py

Work through most of the cspell warnings in python (#13794)

2024-09-17 10:41:46 -05:00

test_birdseye.py

Miscellaneous fixes (0.18 beta) (#23725)

2026-07-15 18:49:05 -06:00

test_builtin.py

perf(util): use monotonic clock and bounded deque in EventsPerSecond (#23520)

2026-06-21 07:38:41 -06:00

test_camera_maintainer.py

Debug replay resolution (#23287)

2026-05-22 08:39:52 -06:00

test_camera_pw.py

Fix invalid escape sequences in RTSP password test (#23740)

2026-07-16 14:58:26 -06:00

test_chat_find_similar_objects.py

Camera access fixes (#22987)

2026-04-23 12:27:49 -06:00

test_classification_enabled.py

Fix enabled flag for custom classification models (#23681)

2026-07-12 03:48:14 -08:00

test_config_util.py

Miscellaneous fixes (0.18 beta) (#23854)

2026-07-29 08:39:01 -06:00

test_config.py

Miscellaneous Fixes (#23709)

2026-07-13 19:55:00 -08:00

test_copy_yuv_to_position.py

Cleanup and organize utils (#7033)

2023-07-06 09:28:50 -05:00

test_debug_replay_job.py

Debug replay fixes (#23270)

2026-05-20 16:37:02 -05:00

test_debug_replay.py

Miscellaneous fixes (#23238)

2026-05-18 22:52:40 -05:00

test_deferred_processor.py

Add deferred real-time processor for enrichments (#22880)

2026-04-14 21:39:44 -06:00

test_dispatcher_runtime_state.py

Miscellaneous fixes (0.18 beta) (#23898)

2026-08-05 07:40:24 -05:00

test_env.py

Improve environment var handling (#22796)

2026-04-07 07:16:02 -06:00

test_export_progress.py

Increase ruff coverage (#23644)

2026-07-06 12:28:02 -05:00

test_export.py

Replace export ffmpeg argument blocklist with a structural allowlist (#23478)

2026-06-13 16:43:22 -06:00

test_ffmpeg_presets.py

Update ffmpeg (#22548)

2026-03-20 08:50:58 -05:00

test_ffmpeg_progress.py

Use Job infrastructure for Debug Replay (#23099)

2026-05-03 14:54:20 -06:00

test_file.py

Enable event snapshot API to honour query params after event ends (#22375)

2026-03-22 13:33:04 -06:00

test_genai_processor_sync.py

Don't require a restart to enable GenAI descriptions (#23964)

2026-08-12 08:55:34 -05:00

test_genai_providers.py

Miscellaneous fixes (0.18 beta) (#23763)

2026-07-21 06:44:33 -06:00

test_go2rtc_stream_auth.py

Miscellaneous fixes (#23513)

2026-06-19 10:10:22 -06:00

test_gpu_stats.py

Miscellaneous fixes (0.18 beta) (#23725)

2026-07-15 18:49:05 -06:00

test_keyframe_analysis.py

Increase ruff coverage (#23644)

2026-07-06 12:28:02 -05:00

test_maintainer.py

Increase ruff coverage (#23644)

2026-07-06 12:28:02 -05:00

test_media_auth.py

Miscellaneous fixes (#23238)

2026-05-18 22:52:40 -05:00

test_motion_detector.py

Skip motion threshold configuration (#22255)

2026-03-05 18:20:03 -06:00

test_motion_search_batch.py

Refactor motion search (#23378)

2026-06-01 12:08:46 -05:00

test_motion_search_decode.py

Refactor motion search (#23378)

2026-06-01 12:08:46 -05:00

test_motion_search_spatial.py

Refactor motion search (#23378)

2026-06-01 12:08:46 -05:00

test_mqtt_topic_registration.py

Register per-camera notifications MQTT callbacks (#23637)

2026-07-05 17:24:39 -05:00

test_network_config.py

Pin the internal auth port to the value nginx bound at startup (#23909)

2026-08-05 07:39:56 -05:00

test_norfair_distance.py

guard norfair distance against non-finite and zero-area boxes that could crash autotracking cameras (#23475)

2026-06-13 16:23:30 -05:00

test_obects.py

perf(track): use sum()/len() instead of np.mean in average_boxes (#23521)

2026-06-23 15:47:04 -06:00

test_object_detector.py

Improve async object detector support (#17712)

2025-04-15 08:55:38 -05:00

test_onvif_probe.py

Support onvif PasswordText cameras in the add camera wizard (#23365)

2026-05-31 08:20:09 -06:00

test_output_ws_auth.py

Camera access fixes (#22987)

2026-04-23 12:27:49 -06:00

test_post_processing.py

Fix wrong box format passed to cv2.dnn.NMSBoxes (#23876)

2026-07-31 08:57:23 -05:00

test_preview_loader.py

Offline preview image (#21752)

2026-02-26 21:27:56 -07:00

test_profiles.py

Miscellaneous fixes (0.18 beta) (#23898)

2026-08-05 07:40:24 -05:00

test_proxy_auth.py

Various Tweaks (#22609)

2026-03-24 13:53:39 -06:00

test_ptz_autotrack.py

Miscellaneous fixes (0.18 beta) (#23725)

2026-07-15 18:49:05 -06:00

test_ptz_onvif.py

Miscellaneous fixes (0.18 beta) (#23892)

2026-08-03 08:18:28 -05:00

test_record_retention.py

Improve recording retention logic (#20506)

2025-10-15 11:09:28 -06:00

test_reduce_boxes.py

Smarter Regions (#8194)

2023-10-18 18:21:52 -05:00

test_review_manual_event_severity.py

Categorize manual events as alerts when their label is an alert label (#23981)

2026-08-13 11:16:02 -06:00

test_runtime_state.py

Fix persisted runtime camera toggles (#23734)

2026-07-16 09:05:21 -05:00

test_shared_memory_frame_manager.py

Debug replay resolution (#23287)

2026-05-22 08:39:52 -06:00

test_sqlitevecq_embeddings.py

Miscellaneous fixes (0.18 beta) (#23763)

2026-07-21 06:44:33 -06:00

test_sqlitevecq_regexp.py

bound REGEXP evaluation with a timeout to prevent ReDoS on the database thread (#23714)

2026-07-14 06:27:00 -05:00

test_stationary_classifier.py

perf(track): avoid per-frame allocations and list lookups in tracker (#23523)

2026-06-23 15:24:05 -06:00

test_storage.py

Pull count of detection events by label into prometheus metrics (#20119)

2025-09-19 06:27:20 -06:00

test_update_yaml.py

fix config corruption when deleting the last commented mask or zone (#23627)

2026-07-04 17:10:32 -06:00

test_util_path.py

sanitize user-supplied path components (#23990)

2026-08-13 21:59:46 -05:00

test_video.py

perf(util): cut redundant work in per-frame detection consolidation (#23522)

2026-06-23 15:23:18 -06:00

test_webpush_camera_monitoring.py

Camera access fixes (#22987)

2026-04-23 12:27:49 -06:00

test_webpush_suspend.py

Miscellaneous fixes (#23651)

2026-07-08 08:27:38 -05:00

test_ws_auth.py

Miscellaneous fixes (0.18 beta) (#23736)

2026-07-17 08:00:15 -06:00

test_ws_outbound_filter.py

Filter outbound websocket broadcasts by per-recipient camera access (#23256)

2026-05-19 14:51:16 -05:00

test_yuv_region_2_rgb.py

Cleanup and organize utils (#7033)

2023-07-06 09:28:50 -05:00