github/Bose-SoundTouch
1
0
Fork 0
mirror of https://github.com/gesellix/Bose-SoundTouch.git synced 2026-08-24 14:47:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(datastore): sanitize wrapped errors in malformed-XML logs (CodeQL go/log-injection)

Browse Source 
The #458 empty/0-byte resilience logging logged the raw xml.Unmarshal error with
%v. A parse error can echo attacker-controlled file content, so a newline-bearing
error string reached the log unsanitized (CodeQL go/log-injection, medium). Wrap
the error with sanitizeErr (strips \n/\r), the barrier logutil.go documents.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Tobias Gesellchen
2026-06-04 19:38:12 +02:00
co-authored by Claude Opus 4.8
parent b1a5428ebf
commit 188c5521b7
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/service/datastore/datastore.go
+3 -3
View File
@@ -999,7 +999,7 @@ func (ds *DataStore) readPresetsLocked(account, device string) ([]models.Service
needsRewrite := !bytes.Equal(normalized, data)
if err := xml.Unmarshal(normalized, &presetsWrap); err != nil {
log.Printf("[Datastore] readPresetsLocked: malformed Presets.xml at %s (%v) — treating as no presets (#458)", sanitizeLog(path), err)
log.Printf("[Datastore] readPresetsLocked: malformed Presets.xml at %s (%s) — treating as no presets (#458)", sanitizeLog(path), sanitizeErr(err))
return []models.ServicePreset{}, false, nil
}
@@ -1342,7 +1342,7 @@ func (ds *DataStore) GetRecents(account, device string) ([]models.ServiceRecent,
var wrap RecentsXML
if err := xml.Unmarshal(data, &wrap); err != nil {
log.Printf("[Datastore] GetRecents: malformed Recents.xml at %s (%v) — treating as no recents (#458)", sanitizeLog(path), err)
log.Printf("[Datastore] GetRecents: malformed Recents.xml at %s (%s) — treating as no recents (#458)", sanitizeLog(path), sanitizeErr(err))
return []models.ServiceRecent{}, nil
}
@@ -1938,7 +1938,7 @@ func (ds *DataStore) GetConfiguredSources(account, device string) ([]models.Conf
}
if err := xml.Unmarshal(data, &sourcesWrap); err != nil {
log.Printf("[Datastore] GetConfiguredSources: malformed Sources.xml at %s (%v) — treating as missing, serving defaults (#458)", sanitizeLog(path), err)
log.Printf("[Datastore] GetConfiguredSources: malformed Sources.xml at %s (%s) — treating as missing, serving defaults (#458)", sanitizeLog(path), sanitizeErr(err))
return defaultSources(), nil
}