[Security] HIGH: 1 issue(s) found in webcam-daemon-ha #4

New issue

Closed

opened 2026-05-14 23:22:58 +00:00 by Mark · 2 comments

Mark commented

2026-05-14 23:22:58 +00:00

Owner

Security Scan Results for `webcam-daemon-ha`

Severity: HIGH
Findings: 1

1. secret_in_diff

Details: Potential Password in URL found in commit 5d703e11
Commit: 5d703e11
Pattern: Password in URL

This issue was auto-generated by the security sweep cron job.

## Security Scan Results for `webcam-daemon-ha` **Severity:** HIGH **Findings:** 1 ### 1. secret_in_diff - **Details:** Potential Password in URL found in commit 5d703e11 - **Commit:** `5d703e11` - **Pattern:** `Password in URL` --- *This issue was auto-generated by the security sweep cron job.*

Mark commented

2026-05-15 09:39:53 +00:00

Author

Owner

STATUS: FALSE POSITIVE — ROOT CAUSE FIXED

Analysis of commit 5d703e1:

No password in URL exists anywhere in this commit, the repo's git history, or the current working tree.
Root cause: The security scanner (security-sweep.py) applies regex patterns to the full multi-line git diff output via re.findall(). The "Password in URL" regex https?://[^:]+:[^@]+@[a-zA-Z0-9.-]+ has a greedy [^@]+ component that spans line boundaries. It matched starting from a legitimate f-string HTTP URL (http://{os.uname().nodename}:{PORT}/stream) and consumed 369 characters across many diff lines until finding the @ in the @app.route decorator that was added in this commit. Per-line scanning produces zero matches.
Fix applied: Patched ~/.hermes/scripts/security-sweep.py — the check_secrets_in_history() function now splits diff content into individual lines before applying regex matching, preventing cross-line false positives.
Verification: After the fix, commit 5d703e1 reports zero "Password in URL" findings. Real secrets like http://user:pass@host still match correctly; legitimate URLs without credentials do not.

Closing as resolved (scanner bug fixed, no actual security issue).

**STATUS: FALSE POSITIVE — ROOT CAUSE FIXED** Analysis of commit `5d703e1`: 1. **No password in URL exists anywhere** in this commit, the repo's git history, or the current working tree. 2. **Root cause**: The security scanner (`security-sweep.py`) applies regex patterns to the full multi-line git diff output via `re.findall()`. The "Password in URL" regex `https?://[^:]+:[^@]+@[a-zA-Z0-9.-]+` has a greedy `[^@]+` component that spans line boundaries. It matched starting from a legitimate f-string HTTP URL (`http://{os.uname().nodename}:{PORT}/stream`) and consumed 369 characters across many diff lines until finding the `@` in the `@app.route` decorator that was added in this commit. Per-line scanning produces zero matches. 3. **Fix applied**: Patched `~/.hermes/scripts/security-sweep.py` — the `check_secrets_in_history()` function now splits diff content into individual lines before applying regex matching, preventing cross-line false positives. 4. **Verification**: After the fix, commit `5d703e1` reports zero "Password in URL" findings. Real secrets like `http://user:pass@host` still match correctly; legitimate URLs without credentials do not. Closing as resolved (scanner bug fixed, no actual security issue).