From 188c5521b71a485261c2d234d41aa76714d65e18 Mon Sep 17 00:00:00 2001 From: Tobias Gesellchen Date: Thu, 4 Jun 2026 19:34:10 +0200 Subject: [PATCH] fix(datastore): sanitize wrapped errors in malformed-XML logs (CodeQL go/log-injection) The #458 empty/0-byte resilience logging logged the raw xml.Unmarshal error with %v. A parse error can echo attacker-controlled file content, so a newline-bearing error string reached the log unsanitized (CodeQL go/log-injection, medium). Wrap the error with sanitizeErr (strips \n/\r), the barrier logutil.go documents. Co-Authored-By: Claude Opus 4.8 (1M context) --- pkg/service/datastore/datastore.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkg/service/datastore/datastore.go b/pkg/service/datastore/datastore.go index bae1dac..2c88c18 100644 --- a/pkg/service/datastore/datastore.go +++ b/pkg/service/datastore/datastore.go @@ -999,7 +999,7 @@ func (ds *DataStore) readPresetsLocked(account, device string) ([]models.Service needsRewrite := !bytes.Equal(normalized, data) if err := xml.Unmarshal(normalized, &presetsWrap); err != nil { - log.Printf("[Datastore] readPresetsLocked: malformed Presets.xml at %s (%v) — treating as no presets (#458)", sanitizeLog(path), err) + log.Printf("[Datastore] readPresetsLocked: malformed Presets.xml at %s (%s) — treating as no presets (#458)", sanitizeLog(path), sanitizeErr(err)) return []models.ServicePreset{}, false, nil } @@ -1342,7 +1342,7 @@ func (ds *DataStore) GetRecents(account, device string) ([]models.ServiceRecent, var wrap RecentsXML if err := xml.Unmarshal(data, &wrap); err != nil { - log.Printf("[Datastore] GetRecents: malformed Recents.xml at %s (%v) — treating as no recents (#458)", sanitizeLog(path), err) + log.Printf("[Datastore] GetRecents: malformed Recents.xml at %s (%s) — treating as no recents (#458)", sanitizeLog(path), sanitizeErr(err)) return []models.ServiceRecent{}, nil } @@ -1938,7 +1938,7 @@ func (ds *DataStore) GetConfiguredSources(account, device string) ([]models.Conf } if err := xml.Unmarshal(data, &sourcesWrap); err != nil { - log.Printf("[Datastore] GetConfiguredSources: malformed Sources.xml at %s (%v) — treating as missing, serving defaults (#458)", sanitizeLog(path), err) + log.Printf("[Datastore] GetConfiguredSources: malformed Sources.xml at %s (%s) — treating as missing, serving defaults (#458)", sanitizeLog(path), sanitizeErr(err)) return defaultSources(), nil }