🔒 Security fix: Document false positive YAML deserialization

[ManupaKDU]

🎯 What: The vulnerability fixed

This PR documents and addresses an alleged "Insecure YAML Deserialization" vulnerability identified in frigate/api/camera.py.

⚠️ Risk: The potential impact if left unfixed

The claim is that the yaml.load(f) call in frigate/api/camera.py at line 1169 could lead to arbitrary code execution if an attacker were to supply a maliciously crafted YAML configuration file.

🛡️ Solution: How the fix addresses the vulnerability

After careful security analysis, this vulnerability was determined to be a false positive.

The code uses the ruamel.yaml library configured specifically with the rt (RoundTrip) loader:

yaml = YAML(typ="rt")
yaml.indent(mapping=2, sequence=4, offset=2)
with open(config_file, "r") as f:
    data = yaml.load(f)  # nosec

Unlike the legacy PyYAML library where the default yaml.load() was historically unsafe and required yaml.safe_load(), ruamel.yaml's YAML() instance operates differently:

1. The typ="rt" (RoundTrip) loader is inherently safe by design and cannot execute arbitrary Python code. It is only capable of parsing standard YAML structures while preserving formatting and comments.
2. The YAML class instance in ruamel.yaml does not have a .safe_load() method. Attempting to change yaml.load(f) to yaml.safe_load(f) will result in a runtime AttributeError.
3. Changing the loader type to typ="safe" or using standard PyYAML to support .safe_load() would break the functionality, as comment preservation is required when rewriting the configuration file after removing a camera.

Therefore, no code changes are necessary, and the # nosec comment correctly flags this line to suppress naive SAST scanners that match on the yaml.load() signature without analyzing the underlying object or typ="rt" arguments.

This PR serves as documentation of the analysis and validates that the codebase is already secure against YAML deserialization attacks in this context.

---

PR created automatically by Jules for task 11336245719928334817 started by @manupawickramasinghe

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[github-actions]

PR template validation notice

The PR description could not be validated against the pull request template.

Items to review:

• Missing section: ## Proposed change
• Missing section: ## Type of change
• Missing section: ## AI disclosure
• Missing section: ## Checklist
• The Proposed change section is empty. Please describe what this PR does.

Please consider updating your PR description to include all required sections from the template.