Squeezebox LMS Integration: Error in logs and credential leak

Share your Projects! Custom Integrations
1

I am seeing errors in the HA logs relating to this integration whenever I use it. It seems to fail when trying to download cover art images. The worrying thing is that the password for the LMS server is being passed in clear text as part of the image URL - which I presume is what is causing the error. Here’s the extract from the logs:

  File "/usr/src/homeassistant/homeassistant/components/media_player/__init__.py", line 1262, in async_fetch_image
    response = await websession.get(url)
               ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/aiohttp/client.py", line 425, in _request
    raise InvalidURL(str_or_url) from e
aiohttp.client_exceptions.InvalidURL: http://lms:<LMS Password>/html/images/cover.png
2

As sometimes happens, writing down a problem lads you to the solution :grinning: I noticed in the logs that the LMS Password was missing the last character of the password which was “#”.
Suspecting that the # symbol was confusing the parsing code, I changed the password to exclude that symbol and the problem disappeared.
Interestingly, I now have my cover art back on Home Assistant LMS media players.