Turn server sdk config #1715
Turn server sdk config #1715
Conversation
digaobarbosa
requested review from
PawelPeczek-Roboflow,
grzegorz-roboflow,
hansent,
probicheaux and
yeldarby
as code owners
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| return self._config.turn_server | ||
|
|
||
| # 2. Skip TURN for localhost connections | ||
| if not self._api_url.startswith(("https://serverless.roboflow.com")): |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 6 days ago
To fix this vulnerability safely, we should parse the _api_url using Python's urllib.parse module and compare the extracted hostname property, rather than relying on prefix substring checks. This ensures that checks are made against the actual host and not against potentially misleading prefixes or embedded substrings elsewhere in the URL. Specifically, replace .startswith(("https://serverless.roboflow.com")) with a check like urlparse(self._api_url).hostname == "serverless.roboflow.com". If you want to also allow subdomains (e.g., api.serverless.roboflow.com), use .endswith(".serverless.roboflow.com") or an explicit allow-list. You will need to import urlparse from urllib.parse if not already imported in this file.
| @@ -14,6 +14,7 @@ | ||
|
|
||
| import numpy as np | ||
| import requests | ||
| from urllib.parse import urlparse | ||
|
|
||
| from inference_sdk.webrtc.config import StreamConfig | ||
| from inference_sdk.webrtc.sources import StreamSource | ||
| @@ -540,7 +541,8 @@ | ||
| return self._config.turn_server | ||
|
|
||
| # 2. Skip TURN for localhost connections | ||
| if not self._api_url.startswith(("https://serverless.roboflow.com")): | ||
| hostname = urlparse(self._api_url).hostname | ||
| if hostname != "serverless.roboflow.com": | ||
| logger.debug("Skipping TURN for localhost connection") | ||
| return None | ||
|
|
PawelPeczek-Roboflow
left a comment
PawelPeczek-Roboflow
left a comment
There was a problem hiding this comment.
Please clarify how this PR stands in context of #1701
PawelPeczek-Roboflow
changed the base branch from
main
to
webrtc-python-sdk-webcam
|
Security issue to be adressed |
Description
Configuring turn server by default
Type of change
How has this change been tested, please provide a testcase or example of how you tested the change?
locally
Any specific deployment considerations
nobne
Docs