fix: stop camera credentials leaking through logs and the monitor settings UI (#308)

* fix(logs): find credentials under any URL scheme, keep ERROR details structured

A camera's password lives in the monitor's source path as URL userinfo
(rtsp://admin:secret@cam/live). Redaction never found it: sanitizeUrl fires
only on strings starting http:// or https://, and sanitizeLogMessage matches
only /https?:\/\//, so rtsp, rtmp, and anything mid-string passed through
verbatim. The HTTP client logs response bodies, and its failure branch logs
at ERROR, which clears the default level with no opt-in, so a failed
monitors.json request wrote every camera credential to the log file.

lib/security/url-credentials.ts owns the one regex that knows where a
password sits in a URL, whatever the scheme, wherever in the string. The two
copies of the string rules in log-sanitizer collapse into one sanitizeString
that runs it first. URL handling now precedes form-data handling, so a query
string with a password in it stays a readable URL instead of being
percent-encoded into one blob.

The ERROR path serialized its details with JSON.stringify before sanitizing.
The sanitizer redacts by key, and a flattened object has no keys, so every
secret in an ERROR detail survived across ~130 call sites. Details are
passed as objects at every level now; both sinks already pretty-print them.

Also: cookie and credential join the sensitive keys (ZMSESSID rode out in
logged headers), a sensitive key holding an object is recursed into rather
than stringified to '[obje...', a single-field form body no longer needs an
'&' to be recognized, and console.error(error.stack) is sanitized, since the
stack embeds the message where the URL usually is.

Refs #307

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(logs): redact ZoneMinder's own log lines before display and export

The Server tab maps zmLog.Message straight into the display entry, and the
Save and Share buttons export whatever is on screen. zmc and zma log the
ffmpeg command line they run, which carries the camera credential, so the
log file users attach to a bug report handed out every camera password on
the server.

Same sanitizeLogMessage the app's own entries go through, applied where the
server's entries enter the view.

Refs #307

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(monitors): mask camera credentials in the settings dialog

ZoneMinder returns Path, User, and Pass to any account that can view a
monitor, and pre-1.38 servers have nowhere but the source path to keep a
camera password. The dialog rendered both verbatim, with a reveal toggle on
the password field, so the credentials for every camera were one tap and one
screenshot away.

While log redaction is on, the source path shows with its password segment
masked and the Pass field loses its reveal button. Host, port, and stream
path stay readable: that is what makes the field worth showing.

Both fields stay editable. maskUrlCredentials produces what is on screen and
restoreUrlCredentials puts the real password back on save, so changing a
camera's hostname does not silently wipe a password the user cannot see.
Typing over the mask means the new value is the new password.

The same helpers back the log sanitizer, so what the UI hides and what the
logs hide cannot drift.

Refs #307

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(android): keep the access token out of logcat in the PiP activity

PipActivity logged the URL it was handed and the raw media3 playback error.
The URL is an event video URL, which carries the ZoneMinder access token as
a query parameter, and a media3 HTTP failure quotes the URL it failed on
with the cause chain repeating it. Both went to logcat in cleartext, where
any adb session or bug report picks them up.

The onCreate line logs whether a URL arrived rather than the URL. The error
line logs the error code name plus a message with query strings stripped,
and drops the throwable, whose cause chain reprinted the URL.

Not covered by the JS sanitizer: this is native logging, on the other side
of the bridge from lib/logger.ts. No gate reaches it, so it is prose in
agents/project/native.md rather than a lint rule.

Refs #307

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: pliablepixels

agents/project/domain-context.md

@@ -13,6 +13,17 @@ matching reality, fixing it is a protocol change like any rule edit.
   `Tags.Id` accepts a single value only and cannot combine with `Id IN`.
   Repeating `MonitorId` params ORs them. Filter URLs cap out near 8KB;
   batch long id lists.
+- `monitors.json` returns the full monitor row to any account that can view
+  the monitor: `Path`, `User`, `Pass`, `ONVIF_Password`, `Options`. There is
+  no per-field ACL, so an unprivileged account reads every camera's
+  credentials straight from the API. Nothing app-side can prevent that; the
+  app's job is to not widen it by logging or displaying those values
+  (refs #307).
+- A camera password lives inside `Path` as URL userinfo
+  (`rtsp://user:pass@host/stream`), and pre-1.38 servers have no other field
+  for it. `lib/security/url-credentials.ts` is the only place that knows how
+  to find it; both the log sanitizer and the monitor settings UI go through
+  it.
 - Event Server v7.0.22 and later always sends a real `eid` in pushes. The
   historical fake-eid bug (a `Date.now()` value where an event id belongs)
   was app-side tray handling, not the ES.

agents/project/native.md

@@ -6,6 +6,7 @@ Read before Capacitor, TLS, Electron, downloads, or native-path work.
 - Prefer least-breaking hardening. If a fix necessarily breaks an existing native behavior, document accepted risk.
 - Plugin import style, TLS trust, and download paths: Native contract in `AGENTS.project.md`. Additionally, plugins match the `@capacitor/core` major version and get mocks in `tests/setup.ts`.
 - Use `hooks/useCapacitorListener` for plugin listeners.
+- Native logging (`Log.*`, `NSLog`, `CAPLog.print`) never passes through the Logging contract's sanitizer, which lives on the JS side. Nothing gates it, so it is on you: never log a URL handed across the bridge, and never log a media or HTTP error object raw. Stream and event URLs carry the access token in the query, media3 quotes the failing URL in its message and again in the cause chain, and logcat is readable by anyone with adb (refs #307). Log an error code and a scrubbed message instead.
 - `npm run android:sync`, `npm run ios:sync`, and commands that invoke them bump native versions. Revert incidental bumps before commit. Intended bumps are standalone `chore:` commits.
 - Never resolve a promise with a `registerPlugin` proxy: the proxy intercepts every property access as a native method call, so `.then` on it is probed as an unimplemented method and the awaiter hangs forever. An async helper resolves with the plugin module's namespace and callers destructure the plugin from it after the await.
 

app/android/app/src/main/java/com/zoneminder/zmNinjaNG/PipActivity.java

@@ -21,6 +21,12 @@ public class PipActivity extends Activity {
 
     private static final String TAG = "PipActivity";
 
+    /** Drops the query string from any URL in the text. ZoneMinder puts the
+     *  access token in the query, and logcat is readable by anyone with adb. */
+    private static String stripQuery(String text) {
+        return text == null ? "null" : text.replaceAll("\\?\\S*", "");
+    }
+
     private ExoPlayer player;
     private PlayerView playerView;
     private MediaSession mediaSession;
@@ -43,7 +49,10 @@ protected void onCreate(Bundle savedInstanceState) {
         long position = getIntent().getLongExtra("position", 0);
         String aspectRatioStr = getIntent().getStringExtra("aspectRatio");
 
-        Log.d(TAG, "onCreate url=" + url + " position=" + position);
+        // The URL is deliberately not logged. ZoneMinder stream URLs carry the
+        // access token as a query parameter, and logcat is readable by anyone
+        // with adb, so this line handed out a live session token (refs #307).
+        Log.d(TAG, "onCreate hasUrl=" + (url != null) + " position=" + position);
 
         if (url == null) {
             Log.e(TAG, "No URL provided");
@@ -86,7 +95,11 @@ public void onRenderedFirstFrame() {
 
             @Override
             public void onPlayerError(@NonNull androidx.media3.common.PlaybackException error) {
-                Log.e(TAG, "Player error: " + error.getMessage(), error);
+                // Neither the message nor the throwable is logged raw: a media3
+                // HTTP failure quotes the URL it failed on, token and all, and
+                // the cause chain repeats it (refs #307). The error code name
+                // is the part that identifies the failure anyway.
+                Log.e(TAG, "Player error " + error.getErrorCodeName() + ": " + stripQuery(error.getMessage()));
                 finishWithPosition();
             }
         });

app/src/components/monitor-detail/MonitorSettingsDialog.tsx

@@ -20,6 +20,7 @@ import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '.
 import type { Monitor } from '../../api/types';
 import type { MonitorFunction } from '../../pages/hooks/useModeControl';
 import { isZmVersionAtLeast } from '../../lib/zm/zm-version';
+import { maskUrlCredentials, restoreUrlCredentials } from '../../lib/security/url-credentials';
 import { useSettingsStore } from '../../stores/settings';
 import { useCurrentProfile } from '../../hooks/useCurrentProfile';
 import { toast } from 'sonner';
@@ -88,6 +89,17 @@ export function MonitorSettingsDialog({
   const updateProfileSettings = useSettingsStore((state) => state.updateProfileSettings);
   const profileSettings = currentProfile ? getProfileSettings(currentProfile.id) : null;
 
+  // A camera's password lives in the source URL as userinfo, and on pre-1.38
+  // servers that is the only place it can live. While log redaction is on, the
+  // password segment is masked here and the reveal toggle is dropped from the
+  // Pass field, so a screenshot or a shoulder-surfer gets nothing (refs #307).
+  // Both fields stay editable: the real password is restored on save whenever
+  // the mask survives the edit.
+  const maskCredentials = !profileSettings?.disableLogRedaction;
+  const displayedPath = maskCredentials
+    ? maskUrlCredentials(monitor.Path ?? '')
+    : monitor.Path ?? '';
+
   // Per-monitor Go2RTC override
   const globalStreamingMethod = profileSettings?.streamingMethod ?? 'auto';
   const monitorOverride = profileSettings?.monitorStreamingOverrides?.[monitor.Id];
@@ -123,7 +135,7 @@ export function MonitorSettingsDialog({
   const [localVideoWriter, setLocalVideoWriter] = useState(monitor.VideoWriter ?? '0');
 
   // --- Video tab local state ---
-  const [localPath, setLocalPath] = useState(monitor.Path ?? '');
+  const [localPath, setLocalPath] = useState(displayedPath);
   const [localUser, setLocalUser] = useState(monitor.User ?? '');
   const [localPass, setLocalPass] = useState(monitor.Pass ?? '');
   const [localMethod, setLocalMethod] = useState(monitor.Method ?? 'rtpRtsp');
@@ -145,7 +157,7 @@ export function MonitorSettingsDialog({
     Enabled: (monitor.Enabled === '1' || monitor.Enabled === 'true') ? '1' : '0',
     SaveJPEGs: monitor.SaveJPEGs ?? '0',
     VideoWriter: monitor.VideoWriter ?? '0',
-    Path: monitor.Path ?? '',
+    Path: displayedPath,
     User: monitor.User ?? '',
     Pass: monitor.Pass ?? '',
     Method: monitor.Method ?? 'rtpRtsp',
@@ -154,7 +166,7 @@ export function MonitorSettingsDialog({
     Orientation: monitor.Orientation ?? 'ROTATE_0',
     EventStartCommand: monitor.EventStartCommand ?? '',
     EventEndCommand: monitor.EventEndCommand ?? '',
-  }), [monitor]);
+  }), [monitor, displayedPath]);
 
   // One descriptor per editable field. `key` is the ZM API field name sent in
   // the save payload, `applies` gates version-specific fields, `value` is the
@@ -195,6 +207,11 @@ export function MonitorSettingsDialog({
     fields.forEach((f) => {
       if (f.applies && f.value !== serverValues[f.key]) changes[f.key] = f.value;
     });
+    // The Path on screen may carry a mask where the password is. Put the real
+    // one back, unless the user typed over it (refs #307).
+    if (changes.Path !== undefined) {
+      changes.Path = restoreUrlCredentials(changes.Path, monitor.Path ?? '');
+    }
     await onSave(changes);
   };
 
@@ -427,6 +444,7 @@ export function MonitorSettingsDialog({
                     value={localPass}
                     onChange={(e) => setLocalPass(e.target.value)}
                     disabled={!editable || isSaving}
+                    showToggle={!maskCredentials}
                     className="w-40"
                     inputClassName="h-8 text-xs"
                     data-testid="settings-password-input"

app/src/components/monitor-detail/__tests__/MonitorSettingsDialog.test.tsx

@@ -16,8 +16,14 @@ vi.mock('react-i18next', () => ({
   useTranslation: () => ({ t: (key: string) => key }),
 }));
 
+let disableLogRedaction = false;
+
 const settingsState = {
-  getProfileSettings: () => ({ streamingMethod: 'auto', monitorStreamingOverrides: {} }),
+  getProfileSettings: () => ({
+    streamingMethod: 'auto',
+    monitorStreamingOverrides: {},
+    disableLogRedaction,
+  }),
   updateProfileSettings: vi.fn(),
 };
 
@@ -61,6 +67,7 @@ const baseMonitor = {
 describe('MonitorSettingsDialog', () => {
   beforeEach(() => {
     vi.clearAllMocks();
+    disableLogRedaction = false;
   });
 
   it('keeps Save disabled until a field changes', () => {
@@ -100,3 +107,88 @@ describe('MonitorSettingsDialog', () => {
     expect(onSave).toHaveBeenCalledWith({ Path: 'rtsp://cam/new-stream' });
   });
 });
+
+/**
+ * Camera credentials on screen (refs #307).
+ *
+ * Pre-1.38 ZoneMinder has nowhere to put a camera password but the source URL,
+ * so `Path` is where the secret usually is. While log redaction is on, the
+ * password segment is masked and the reveal toggle is gone, but both fields
+ * stay editable: a user changing a camera's hostname must not be forced to
+ * retype a password they cannot see.
+ */
+describe('MonitorSettingsDialog credential masking', () => {
+  const credentialMonitor = {
+    ...baseMonitor,
+    Path: 'rtsp://admin:S3cret@cam.lan:554/h264',
+    Pass: 'S3cret',
+  } as unknown as Monitor;
+
+  const renderDialog = (onSave = vi.fn().mockResolvedValue(undefined)) => {
+    render(
+      <MonitorSettingsDialog
+        open
+        onOpenChange={vi.fn()}
+        monitor={credentialMonitor}
+        zmVersion="1.38.0"
+        onSave={onSave}
+      />
+    );
+    return onSave;
+  };
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    disableLogRedaction = false;
+  });
+
+  it('masks the password in the source path but keeps the host readable', () => {
+    renderDialog();
+    const input = screen.getByTestId('settings-source-input') as HTMLInputElement;
+    expect(input.value).not.toContain('S3cret');
+    expect(input.value).toContain('cam.lan:554/h264');
+    expect(input.value).toContain('admin');
+  });
+
+  it('hides the password reveal toggle while redaction is on', () => {
+    renderDialog();
+    expect(screen.queryByLabelText('common.show_password')).toBeNull();
+  });
+
+  it('restores the real password when the user edits the host around the mask', async () => {
+    const onSave = renderDialog();
+    const input = screen.getByTestId('settings-source-input') as HTMLInputElement;
+
+    fireEvent.change(input, { target: { value: input.value.replace('cam.lan', 'newcam.lan') } });
+    fireEvent.click(screen.getByTestId('settings-video-save-button'));
+
+    await waitFor(() => expect(onSave).toHaveBeenCalledTimes(1));
+    expect(onSave).toHaveBeenCalledWith({ Path: 'rtsp://admin:S3cret@newcam.lan:554/h264' });
+  });
+
+  it('saves a password the user typed over the mask', async () => {
+    const onSave = renderDialog();
+
+    fireEvent.change(screen.getByTestId('settings-source-input'), {
+      target: { value: 'rtsp://admin:brandNew@cam.lan:554/h264' },
+    });
+    fireEvent.click(screen.getByTestId('settings-video-save-button'));
+
+    await waitFor(() => expect(onSave).toHaveBeenCalledTimes(1));
+    expect(onSave).toHaveBeenCalledWith({ Path: 'rtsp://admin:brandNew@cam.lan:554/h264' });
+  });
+
+  it('keeps Save disabled when only the mask is on screen', () => {
+    renderDialog();
+    expect(screen.getByTestId('settings-video-save-button')).toBeDisabled();
+  });
+
+  it('shows the real path and the reveal toggle once redaction is turned off', () => {
+    disableLogRedaction = true;
+    renderDialog();
+
+    const input = screen.getByTestId('settings-source-input') as HTMLInputElement;
+    expect(input.value).toBe('rtsp://admin:S3cret@cam.lan:554/h264');
+    expect(screen.getByLabelText('common.show_password')).toBeTruthy();
+  });
+});

app/src/lib/__tests__/global-error-handlers.test.ts

@@ -45,7 +45,10 @@ describe('installGlobalErrorHandlers', () => {
     expect(logs[0].level).toBe('ERROR');
     expect(logs[0].context).toMatchObject({ component: 'App' });
     expect(logs[0].message).toContain('Uncaught window error');
-    const details = String(logs[0].args?.[0]);
+    // Details reach the sink as the object they were logged as, not
+    // pre-serialized: a flattened string has no keys left for the redaction
+    // rules to match (refs #307).
+    const details = JSON.stringify(logs[0].args?.[0]);
     expect(details).toContain('Uncaught Error: boom');
     expect(details).toContain('app.js:12:5');
     expect(details).toContain('boom');
@@ -61,7 +64,7 @@ describe('installGlobalErrorHandlers', () => {
     expect(logs).toHaveLength(1);
     expect(logs[0].level).toBe('ERROR');
     expect(logs[0].message).toContain('Unhandled promise rejection');
-    const details = String(logs[0].args?.[0]);
+    const details = JSON.stringify(logs[0].args?.[0]);
     expect(details).toContain('async failure');
     expect(event.defaultPrevented).toBe(false);
   });
@@ -75,9 +78,9 @@ describe('installGlobalErrorHandlers', () => {
     // The log store prepends, so logs[0] is the most recent entry.
     const logs = useLogStore.getState().logs;
     expect(logs).toHaveLength(3);
-    expect(String(logs[2].args?.[0])).toContain('42');
-    expect(String(logs[1].args?.[0])).toContain('plain string reason');
-    expect(String(logs[0].args?.[0])).toContain('undefined');
+    expect(JSON.stringify(logs[2].args?.[0])).toContain('42');
+    expect(JSON.stringify(logs[1].args?.[0])).toContain('plain string reason');
+    expect(JSON.stringify(logs[0].args?.[0])).toContain('undefined');
   });
 
   it('truncates long stacks', () => {
@@ -88,7 +91,7 @@ describe('installGlobalErrorHandlers', () => {
 
     const logs = useLogStore.getState().logs;
     expect(logs).toHaveLength(1);
-    const details = String(logs[0].args?.[0]);
+    const details = JSON.stringify(logs[0].args?.[0]);
     expect(details).toContain('truncated');
     // The full untruncated stack must not be present.
     expect(details).not.toContain('x'.repeat(LOGGING.maxStackLength + 500));

app/src/lib/__tests__/log-sanitizer.test.ts

@@ -463,3 +463,87 @@ describe('sanitizeLogArgs', () => {
     expect(result[3]).toEqual(['item1', 'item2']);
   });
 });
+
+/**
+ * Camera credentials reaching the log pipeline (refs #307).
+ *
+ * A ZoneMinder API response carries every monitor's connection settings, and
+ * the HTTP client logs response bodies. These lock the paths that used to
+ * carry a camera password through redaction untouched.
+ */
+describe('camera credentials (refs #307)', () => {
+  beforeEach(() => {
+    setLogRedactionGate({ isRedactionDisabled: () => false });
+  });
+
+  it('redacts the password inside a monitor Path', () => {
+    const body = {
+      monitors: [
+        {
+          Monitor: {
+            Id: '1',
+            Path: 'rtsp://admin:S3cret@192.168.1.9:554/h264',
+            SecondPath: 'rtsp://admin:S3cret@192.168.1.9:554/low',
+          },
+        },
+      ],
+    };
+    expect(JSON.stringify(sanitizeObject(body))).not.toContain('S3cret');
+  });
+
+  it('keeps the host of a monitor Path readable after redacting the password', () => {
+    const result = sanitizeObject({ Path: 'rtsp://admin:S3cret@cam.lan:554/h264' }) as Record<string, string>;
+    expect(result.Path).toBe('rtsp://admin:[REDACTED]@cam.lan:554/h264');
+  });
+
+  it('redacts a credential embedded in an ffmpeg option list', () => {
+    const result = sanitizeObject({
+      Options: '-rtsp_transport tcp -i rtsp://admin:S3cret@cam/live',
+    }) as Record<string, string>;
+    expect(result.Options).not.toContain('S3cret');
+  });
+
+  it('redacts ONVIF credential fields returned by monitors.json', () => {
+    const result = sanitizeObject({
+      ONVIF_Username: 'admin',
+      ONVIF_Password: 'S3cret',
+      onvif_password: 'S3cret',
+    }) as Record<string, string>;
+    expect(result.ONVIF_Password).toBe('[REDACTED]');
+    expect(result.onvif_password).toBe('[REDACTED]');
+    expect(result.ONVIF_Username).toBe('admin');
+  });
+
+  it('redacts a credential URL in a log message, whatever the scheme', () => {
+    const result = sanitizeLogMessage('capture failed for rtsp://admin:S3cret@10.0.0.5/live');
+    expect(result).not.toContain('S3cret');
+  });
+
+  it('redacts the session cookie in logged headers', () => {
+    const result = sanitizeObject({
+      headers: { Cookie: 'ZMSESSID=abcdef123456', 'set-cookie': 'ZMSESSID=abcdef123456' },
+    }) as { headers: Record<string, string> };
+    expect(result.headers.Cookie).not.toContain('abcdef123456');
+    expect(result.headers['set-cookie']).not.toContain('abcdef123456');
+  });
+
+  it('redacts a key named credential', () => {
+    const result = sanitizeObject({ credential: 'S3cret' }) as Record<string, string>;
+    expect(result.credential).toBe('[REDACTED]');
+  });
+
+  it('redacts a single-field form body, which has no & to key off', () => {
+    expect(sanitizeObject('pass=S3cret')).not.toContain('S3cret');
+    const result = sanitizeObject({ body: 'pass=S3cret' }) as Record<string, string>;
+    expect(result.body).not.toContain('S3cret');
+  });
+
+  it('redacts a streaming URL query without mangling it into form data', () => {
+    const result = sanitizeObject({
+      url: 'https://zm.lan/zm/cgi-bin/nph-zms?user=admin&pass=S3cret&connkey=1',
+    }) as Record<string, string>;
+    expect(result.url).not.toContain('S3cret');
+    expect(result.url).toContain('/zm/cgi-bin/nph-zms');
+    expect(result.url).toContain('connkey=1');
+  });
+});