AlexxIT/go2rtc · error

streams: source with spaces may be insecure

Error message

streams: source with spaces may be insecure

What it means

Validate's sanitize guard (regexp matching any whitespace) rejects source URLs containing spaces. This is a security-oriented sanity check: spaces in a source string usually indicate a truncated, malformed, or injection-crafted URL rather than a legitimate address.

Solutions

1. Percent-encode spaces (%20) in query parameters of the source URL
2. Fix the upstream config that produced a truncated or concatenated URL
3. Remove stray whitespace around the source string before validation

When it happens

Trigger: Thrown at internal/streams/handlers.go:131 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of AlexxIT/go2rtc@c245815e75 (2026-09-07). Data as JSON: /api/errors/cba5b5d06cff6948. Report an issue: GitHub.

Appendix: source

Thrown at internal/streams/handlers.go:131

}

var insecure = map[string]bool{}

func MarkInsecure(scheme string) {
	insecure[scheme] = true
}

var sanitize = regexp.MustCompile(`\s`)

func Validate(source string) error {
	// TODO: Review the entire logic of insecure sources
	if i := strings.IndexByte(source, ':'); i > 0 {
		if insecure[source[:i]] {
			return errors.New("streams: source from insecure producer")
		}
	}
	if sanitize.MatchString(source) {
		return errors.New("streams: source with spaces may be insecure")
	}
	return nil
}

View on GitHub (pinned to c245815e75)