{"record":{"id":"924d0a40daad8916","repo":"AlexxIT/go2rtc","slug":"echo-bin-not-in-allow-paths","errorCode":null,"errorMessage":"echo: bin not in allow_paths: ","messagePattern":"echo: bin not in allow_paths: ","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/echo/echo.go","lineNumber":31,"sourceCode":"\nfunc Init() {\n\tvar cfg struct {\n\t\tMod struct {\n\t\t\tAllowPaths []string `yaml:\"allow_paths\"`\n\t\t} `yaml:\"echo\"`\n\t}\n\n\tapp.LoadConfig(&cfg)\n\n\tallowPaths := cfg.Mod.AllowPaths\n\n\tlog := app.GetLogger(\"echo\")\n\n\tstreams.RedirectFunc(\"echo\", func(url string) (string, error) {\n\t\targs := shell.QuoteSplit(url[5:])\n\n\t\tif allowPaths != nil && !slices.Contains(allowPaths, args[0]) {\n\t\t\treturn \"\", errors.New(\"echo: bin not in allow_paths: \" + args[0])\n\t\t}\n\n\t\tb, err := exec.Command(args[0], args[1:]...).Output()\n\t\tif err != nil {\n\t\t\treturn \"\", err\n\t\t}\n\n\t\tb = bytes.TrimSpace(b)\n\n\t\tlog.Debug().Str(\"url\", url).Msgf(\"[echo] %s\", b)\n\n\t\treturn string(b), nil\n\t})\n\tstreams.MarkInsecure(\"echo\")\n}\n","sourceCodeStart":13,"sourceCodeEnd":47,"githubUrl":"https://github.com/AlexxIT/go2rtc/blob/c245815e75e2a5fd60b4290f12bfc04e55a984d3/internal/echo/echo.go#L13-L47","documentation":"The echo stream source runs an external binary from a URL of the form echo:BIN ARGS. For security, when the allow_paths whitelist is configured, only binaries listed in it may be executed. This error means the requested binary (args[0]) is not in that whitelist, so the redirect is refused.","triggerScenarios":"A stream source like echo:mybin arg1 where allow_paths is non-nil and does not contain \"mybin\". Note the allowlist is matched exactly; the trailing space in the message shows an empty bin when the echo: URL has no command (e.g. echo: with empty suffix).","commonSituations":"Typo in the binary name in the stream URL; binary referenced by bare name while allow_paths lists a full path (or vice versa); echo: URL missing the command after the prefix; allow_paths set in config but new command added later without updating it.","solutions":["Add the exact binary name/path used in the echo: URL to allow_paths in the config","Make the binary reference in the echo: URL match the allow_paths entry exactly (same absolute path or same name)","If the URL is echo: with no command, fix the URL to include a binary","If any binary should be allowed, remove the allow_paths restriction entirely (not recommended)"],"exampleFix":"// before\nstreams:\n  cam1: echo:ffmpeg -i ... \nallow_paths: [\"/usr/bin/ffmpeg\"]\n// after\nallow_paths: [\"/usr/bin/ffmpeg\", \"ffmpeg\"]  # or use the full path in the echo: URL","handlingStrategy":"validation","validationCode":"bin := strings.SplitN(url[5:], \" \", 2)[0]\nif allowPaths != nil && !slices.Contains(allowPaths, bin) { return fmt.Errorf(\"bin %q not allowed\", bin) }","typeGuard":null,"tryCatchPattern":"u, err := streams.Get(url); if err != nil && strings.Contains(err.Error(), \"allow_paths\") { /* log which bin to add to allow_paths */ }","preventionTips":["Keep allow_paths entries and echo: URL binaries in identical format (both absolute or both bare names)","Test new echo sources with allow_paths unset first, then lock down","Never leave an empty command after echo:"],"tags":["security","whitelist","exec","go2rtc"],"backgroundTag":"permission-denied","analyzedSha":"c245815e75e2a5fd60b4290f12bfc04e55a984d3","analyzedAt":"2026-09-07T11:47:02.965Z","contentChangedAt":"2026-09-07T11:47:02.965Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}