Malicious Long Unicode filenames may cause a Multiple Application-level Denial of Service

This user-provided value can reach a costly Unicode normalization operation.

Paths

1. frigate/api/media.py

   <pre><code class="python">@MediaBp.route("/&lt;camera_name&gt;/start/&lt;int:start_ts&gt;/end/&lt;int:end_ts&gt;/clip.mp4") @MediaBp.route("/&lt;camera_name&gt;/start/&lt;float:start_ts&gt;/end/&lt;float:end_ts&gt;/clip.mp4") def recording_clip(camera_name, <strong>start_ts</strong>, end_ts): download = request.args.get("download", type=bool) </code></pre>

2. frigate/api/media.py

   <pre><code class="python"> playlist_lines.append(f"outpoint {int(end_ts - clip.start_time)}") file_name = secure_filename(<strong>f"clip_{camera_name}_{start_ts}-{end_ts}.mp4"</strong>) path = os.path.join(CACHE_DIR, file_name) </code></pre>

frigate/api/media.py

This user-provided value can reach a costly Unicode normalization operation.

Paths

1. frigate/api/media.py

   <pre><code class="python">@MediaBp.route("/&lt;camera_name&gt;/start/&lt;int:start_ts&gt;/end/&lt;int:end_ts&gt;/clip.mp4") @MediaBp.route("/&lt;camera_name&gt;/start/&lt;float:start_ts&gt;/end/&lt;float:end_ts&gt;/clip.mp4") def recording_clip(camera_name, start_ts, <strong>end_ts</strong>): download = request.args.get("download", type=bool) </code></pre>

2. frigate/api/media.py

   <pre><code class="python"> playlist_lines.append(f"outpoint {int(end_ts - clip.start_time)}") file_name = secure_filename(<strong>f"clip_{camera_name}_{start_ts}-{end_ts}.mp4"</strong>) path = os.path.join(CACHE_DIR, file_name) </code></pre>

frigate/api/media.py

This user-provided value can reach a costly Unicode normalization operation.

Paths

1. frigate/api/media.py

   <pre><code class="python"> jsonify, make_response, <strong>request</strong>, ) from peewee import DoesNotExist, fn </code></pre>

2. frigate/api/media.py

   <pre><code class="python"> jsonify, make_response, <strong>request</strong>, ) from peewee import DoesNotExist, fn </code></pre>

3. frigate/api/media.py

   <pre><code class="python"> ) json: dict[str, any] = <strong>request</strong>.get_json(silent=True) or {} playback_factor = json.get("playback", "realtime") name: Optional[str] = json.get("name") </code></pre>

4. frigate/api/media.py

   <pre><code class="python"> ) <strong>json</strong>: dict[str, any] = request.get_json(silent=True) or {} playback_factor = json.get("playback", "realtime") name: Optional[str] = json.get("name") </code></pre>

5. frigate/api/media.py

   <pre><code class="python"> json: dict[str, any] = request.get_json(silent=True) or {} playback_factor = json.get("playback", "realtime") name: Optional[str] = <strong>json</strong>.get("name") recordings_count = ( </code></pre>

6. frigate/api/media.py

   <pre><code class="python"> json: dict[str, any] = request.get_json(silent=True) or {} playback_factor = json.get("playback", "realtime") name: Optional[str] = <strong>json.get("name")</strong> recordings_count = ( </code></pre>

7. frigate/api/media.py

   <pre><code class="python"> json: dict[str, any] = request.get_json(silent=True) or {} playback_factor = json.get("playback", "realtime") <strong>name</strong>: Optional[str] = json.get("name") recordings_count = ( </code></pre>

8. frigate/api/media.py

   <pre><code class="python"> current_app.frigate_config, camera_name, secure_filename(<strong>name.replace(" ", "_")</strong>) if name else None, int(start_time), int(end_time), </code></pre>

frigate/api/media.py

This user-provided value can reach a costly Unicode normalization operation.

Paths

1. frigate/api/media.py

   <pre><code class="python"> @MediaBp.route("/export/&lt;file_name_current&gt;/&lt;file_name_new&gt;", methods=["PATCH"]) def export_rename(<strong>file_name_current</strong>, file_name_new: str): safe_file_name_current = secure_filename( export_filename_check_extension(file_name_current) </code></pre>

2. frigate/api/media.py

   <pre><code class="python">def export_rename(file_name_current, file_name_new: str): safe_file_name_current = secure_filename( export_filename_check_extension(<strong>file_name_current</strong>) ) file_current = os.path.join(EXPORT_DIR, safe_file_name_current) </code></pre>

3. frigate/api/media.py

   <pre><code class="python"> def export_filename_check_extension(<strong>filename</strong>: str): if filename.endswith(".mp4"): return filename </code></pre>

4. frigate/api/media.py

   <pre><code class="python">def export_filename_check_extension(filename: str): if filename.endswith(".mp4"): return <strong>filename</strong> else: return filename + ".mp4" </code></pre>

5. frigate/api/media.py

   <pre><code class="python">def export_rename(file_name_current, file_name_new: str): safe_file_name_current = secure_filename( <strong>export_filename_check_extension(file_name_current)</strong> ) file_current = os.path.join(EXPORT_DIR, safe_file_name_current) </code></pre>

1. frigate/api/media.py

   <pre><code class="python"> @MediaBp.route("/export/&lt;file_name_current&gt;/&lt;file_name_new&gt;", methods=["PATCH"]) def export_rename(<strong>file_name_current</strong>, file_name_new: str): safe_file_name_current = secure_filename( export_filename_check_extension(file_name_current) </code></pre>

2. frigate/api/media.py

   <pre><code class="python">def export_rename(file_name_current, file_name_new: str): safe_file_name_current = secure_filename( export_filename_check_extension(<strong>file_name_current</strong>) ) file_current = os.path.join(EXPORT_DIR, safe_file_name_current) </code></pre>

3. frigate/api/media.py

   <pre><code class="python"> def export_filename_check_extension(<strong>filename</strong>: str): if filename.endswith(".mp4"): return filename </code></pre>

4. frigate/api/media.py

   <pre><code class="python"> return filename else: return <strong>filename + ".mp4"</strong> </code></pre>

5. frigate/api/media.py

   <pre><code class="python">def export_rename(file_name_current, file_name_new: str): safe_file_name_current = secure_filename( <strong>export_filename_check_extension(file_name_current)</strong> ) file_current = os.path.join(EXPORT_DIR, safe_file_name_current) </code></pre>

frigate/api/media.py

This user-provided value can reach a costly Unicode normalization operation.

Paths

1. frigate/api/media.py

   <pre><code class="python"> @MediaBp.route("/export/&lt;file_name_current&gt;/&lt;file_name_new&gt;", methods=["PATCH"]) def export_rename(file_name_current, <strong>file_name_new</strong>: str): safe_file_name_current = secure_filename( export_filename_check_extension(file_name_current) </code></pre>

2. frigate/api/media.py

   <pre><code class="python"> ) safe_file_name_new = secure_filename(export_filename_check_extension(<strong>file_name_new</strong>)) file_new = os.path.join(EXPORT_DIR, safe_file_name_new) </code></pre>

3. frigate/api/media.py

   <pre><code class="python"> def export_filename_check_extension(<strong>filename</strong>: str): if filename.endswith(".mp4"): return filename </code></pre>

4. frigate/api/media.py

   <pre><code class="python">def export_filename_check_extension(filename: str): if filename.endswith(".mp4"): return <strong>filename</strong> else: return filename + ".mp4" </code></pre>

5. frigate/api/media.py

   <pre><code class="python"> ) safe_file_name_new = secure_filename(<strong>export_filename_check_extension(file_name_new)</strong>) file_new = os.path.join(EXPORT_DIR, safe_file_name_new) </code></pre>

1. frigate/api/media.py

   <pre><code class="python"> @MediaBp.route("/export/&lt;file_name_current&gt;/&lt;file_name_new&gt;", methods=["PATCH"]) def export_rename(file_name_current, <strong>file_name_new</strong>: str): safe_file_name_current = secure_filename( export_filename_check_extension(file_name_current) </code></pre>

2. frigate/api/media.py

   <pre><code class="python"> ) safe_file_name_new = secure_filename(export_filename_check_extension(<strong>file_name_new</strong>)) file_new = os.path.join(EXPORT_DIR, safe_file_name_new) </code></pre>

3. frigate/api/media.py

   <pre><code class="python"> def export_filename_check_extension(<strong>filename</strong>: str): if filename.endswith(".mp4"): return filename </code></pre>

4. frigate/api/media.py

   <pre><code class="python"> return filename else: return <strong>filename + ".mp4"</strong> </code></pre>

5. frigate/api/media.py

   <pre><code class="python"> ) safe_file_name_new = secure_filename(<strong>export_filename_check_extension(file_name_new)</strong>) file_new = os.path.join(EXPORT_DIR, safe_file_name_new) </code></pre>

[frigate/api/media.py](https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f2970