Sanitize source labels in Prometheus metrics to prevent credential leaks

Strip credentials, query parameters, and fragments from source URLs
exposed as Prometheus label values. Add METRICS_INCLUDE_SOURCE_LABELS
env var to optionally disable source labels entirely for sensitive
network environments.

Author: alexnorell

inference/core/env.py

@@ -271,6 +271,14 @@
 
 ENABLE_PROMETHEUS = str2bool(os.getenv("ENABLE_PROMETHEUS", False))
 
+# Controls whether video source URLs (e.g. RTSP endpoints) are included as
+# Prometheus label values.  Credentials and query parameters are always
+# stripped, but the host/IP and path remain visible.  Set to "false" to omit
+# source labels entirely if internal network topology is sensitive.
+METRICS_INCLUDE_SOURCE_LABELS = str2bool(
+    os.getenv("METRICS_INCLUDE_SOURCE_LABELS", True)
+)
+
 # Flag to enforce FPS, default is False
 ENFORCE_FPS = str2bool(os.getenv("ENFORCE_FPS", False))
 MAX_FPS = os.getenv("MAX_FPS")

inference/core/managers/prometheus.py

@@ -3,12 +3,14 @@
 import re
 import time
 from typing import Callable, Dict, List
+from urllib.parse import urlparse, urlunparse
 
 from prometheus_client.core import REGISTRY, CounterMetricFamily, GaugeMetricFamily
 from prometheus_client.registry import Collector
 from prometheus_fastapi_instrumentator import Instrumentator
 
 from inference.core.devices.utils import GLOBAL_INFERENCE_SERVER_ID
+from inference.core.env import METRICS_INCLUDE_SOURCE_LABELS
 from inference.core.logger import logger
 from inference.core.managers.metrics import get_model_metrics
 
@@ -125,13 +127,26 @@ def _average_source_fps(sources_metadata: List[dict]) -> float:
             return 0.0
         return sum(values) / len(values)
 
+    @staticmethod
+    def _sanitize_source_reference(ref: str) -> str:
+        """Strip credentials and query parameters from URLs to avoid leaking
+        secrets in metrics."""
+        parsed = urlparse(ref)
+        if parsed.scheme and parsed.hostname:
+            netloc = parsed.hostname + (f":{parsed.port}" if parsed.port else "")
+            sanitized = parsed._replace(netloc=netloc, query="", fragment="")
+            return urlunparse(sanitized)
+        return ref
+
     @staticmethod
     def _extract_source_label(sources_metadata: List[dict]) -> str:
+        if not METRICS_INCLUDE_SOURCE_LABELS:
+            return ""
         refs = []
         for src in sources_metadata:
             ref = src.get("source_reference")
             if ref is not None:
-                refs.append(str(ref))
+                refs.append(CustomCollector._sanitize_source_reference(str(ref)))
         return ",".join(refs) if refs else ""
 
     def sanitize_string(self, input_string):

tests/inference/unit_tests/core/managers/test_prometheus.py

@@ -307,6 +307,62 @@ def test_negative_fps_excluded(self):
         assert CustomCollector._average_source_fps(metadata) == 25.0
 
 
+class TestSanitizeSourceReference:
+    def test_strips_credentials_from_rtsp_url(self):
+        assert (
+            CustomCollector._sanitize_source_reference("rtsp://admin:secret@192.168.1.1:554/stream1")
+            == "rtsp://192.168.1.1:554/stream1"
+        )
+
+    def test_strips_credentials_from_http_url(self):
+        assert (
+            CustomCollector._sanitize_source_reference("http://user:pass@example.com:8080/feed")
+            == "http://example.com:8080/feed"
+        )
+
+    def test_strips_username_only(self):
+        assert (
+            CustomCollector._sanitize_source_reference("rtsp://admin@10.0.0.1/live")
+            == "rtsp://10.0.0.1/live"
+        )
+
+    def test_preserves_url_without_credentials(self):
+        assert (
+            CustomCollector._sanitize_source_reference("rtsp://192.168.1.1:554/stream")
+            == "rtsp://192.168.1.1:554/stream"
+        )
+
+    def test_preserves_device_index(self):
+        assert CustomCollector._sanitize_source_reference("0") == "0"
+
+    def test_preserves_file_path(self):
+        assert CustomCollector._sanitize_source_reference("/dev/video0") == "/dev/video0"
+
+    def test_preserves_regular_file_path(self):
+        assert (
+            CustomCollector._sanitize_source_reference("/home/user/video.mp4")
+            == "/home/user/video.mp4"
+        )
+
+    def test_strips_credentials_and_query_params(self):
+        assert (
+            CustomCollector._sanitize_source_reference("rtsp://user:p%40ss@cam.local:554/ch1?transport=tcp")
+            == "rtsp://cam.local:554/ch1"
+        )
+
+    def test_strips_query_params_without_credentials(self):
+        assert (
+            CustomCollector._sanitize_source_reference("rtsp://cam.local:554/stream?token=secret123&channel=1")
+            == "rtsp://cam.local:554/stream"
+        )
+
+    def test_strips_fragment(self):
+        assert (
+            CustomCollector._sanitize_source_reference("http://example.com/feed#section")
+            == "http://example.com/feed"
+        )
+
+
 class TestExtractSourceLabel:
     def test_single_source(self):
         metadata = [
@@ -338,6 +394,31 @@ def test_none_source_reference_excluded(self):
         ]
         assert CustomCollector._extract_source_label(metadata) == "rtsp://cam1.local/stream"
 
+    def test_strips_credentials_from_source_references(self):
+        metadata = [
+            {"source_reference": "rtsp://admin:secret@192.168.1.1:554/stream", "source_id": 0},
+            {"source_reference": "rtsp://user:pass@10.0.0.1:554/live", "source_id": 1},
+        ]
+        assert (
+            CustomCollector._extract_source_label(metadata)
+            == "rtsp://192.168.1.1:554/stream,rtsp://10.0.0.1:554/live"
+        )
+
+    def test_strips_query_params_from_source_references(self):
+        metadata = [
+            {"source_reference": "rtsp://cam.local/stream?token=secret&channel=1", "source_id": 0},
+        ]
+        assert CustomCollector._extract_source_label(metadata) == "rtsp://cam.local/stream"
+
+    def test_returns_empty_when_source_labels_disabled(self):
+        metadata = [
+            {"source_reference": "rtsp://cam1.local/stream", "source_id": 0},
+        ]
+        with patch(
+            "inference.core.managers.prometheus.METRICS_INCLUDE_SOURCE_LABELS", False
+        ):
+            assert CustomCollector._extract_source_label(metadata) == ""
+
 
 def _find_samples(metric_families, name):
     """Return all samples for a given metric family name."""