Summary
The username, lineId, and productionId path parameters in POST /api/v1/whip/:productionId/:lineId/:username (and the WHEP equivalent) are URL-decoded by Fastify and interpolated directly into log messages without sanitization.
Location
src/api_whip.ts lines ~131, ~210- WHEP equivalent routes
Details
The TypeBox schema only enforces maxLength: 200 with no pattern constraint on username. An attacker can send a username containing newline characters (%0a), carriage returns (%0d), or ANSI escape codes (%1b[31m), which allows forging fake log entries or corrupting log files.
Example attack:
POST /api/v1/whip/1/line1/admin%0aFAKE%20INFO%20message%20injected
The lineId and productionId parameters in WHIP/WHEP routes also lack the numeric-only pattern constraint that other production routes enforce.
Recommendation
Add a restrictive pattern to the username, lineId, and productionId schema entries in WHIP/WHEP routes:
username: Type.String({ maxLength: 200, pattern: '^[\\w\\s.-]{1,200}$' })Alternatively, sanitize log output by stripping or encoding control characters before logging user-supplied values.
Severity
MEDIUM
Summary
The
username,lineId, andproductionIdpath parameters inPOST /api/v1/whip/:productionId/:lineId/:username(and the WHEP equivalent) are URL-decoded by Fastify and interpolated directly into log messages without sanitization.Location
src/api_whip.tslines ~131, ~210Details
The TypeBox schema only enforces
maxLength: 200with no pattern constraint onusername. An attacker can send a username containing newline characters (%0a), carriage returns (%0d), or ANSI escape codes (%1b[31m), which allows forging fake log entries or corrupting log files.Example attack:
The
lineIdandproductionIdparameters in WHIP/WHEP routes also lack the numeric-onlypatternconstraint that other production routes enforce.Recommendation
Add a restrictive pattern to the
username,lineId, andproductionIdschema entries in WHIP/WHEP routes:Alternatively, sanitize log output by stripping or encoding control characters before logging user-supplied values.
Severity
MEDIUM