From 2836fdae13c87c50958e69e986b17a7837d4f25d Mon Sep 17 00:00:00 2001
From: Alex X <alexey.khit@gmail.com>
Date: Tue, 11 Nov 2025 14:59:05 +0300
Subject: [PATCH] Add config allow_paths for echo module

---
 internal/echo/echo.go | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/internal/echo/echo.go b/internal/echo/echo.go
index fb105cec..e8dffbd2 100644
--- a/internal/echo/echo.go
+++ b/internal/echo/echo.go
@@ -2,7 +2,9 @@ package echo
 
 import (
 	"bytes"
+	"errors"
 	"os/exec"
+	"slices"
 
 	"github.com/AlexxIT/go2rtc/internal/app"
 	"github.com/AlexxIT/go2rtc/internal/streams"
@@ -10,11 +12,25 @@ import (
 )
 
 func Init() {
+	var cfg struct {
+		Mod struct {
+			AllowPaths []string `yaml:"allow_paths"`
+		} `yaml:"echo"`
+	}
+
+	app.LoadConfig(&cfg)
+
+	allowPaths := cfg.Mod.AllowPaths
+
 	log := app.GetLogger("echo")
 
 	streams.RedirectFunc("echo", func(url string) (string, error) {
 		args := shell.QuoteSplit(url[5:])
 
+		if allowPaths != nil && !slices.Contains(allowPaths, args[0]) {
+			return "", errors.New("echo: bin not in allow_paths: " + args[0])
+		}
+
 		b, err := exec.Command(args[0], args[1:]...).Output()
 		if err != nil {
 			return "", err