github/Bose-SoundTouch
1
0
Fork 0
mirror of https://github.com/gesellix/Bose-SoundTouch.git synced 2026-08-18 08:36:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(web): stop TTS proxy from using a browser-supplied service URL (SSRF)

Browse Source 
CodeQL flagged "uncontrolled data used in network request": the
soundtouch-web TTS proxy built its outbound request URL from the
client-supplied serviceUrl, letting any LAN caller use the endpoint as an
SSRF proxy. The proxy target must be the operator-configured --service-url.

- handler: use only app.ServiceURL; drop the client-supplied serviceUrl
  field and fallback.
- web TTS view: show the configured service URL read-only with an
  explanation of why it can't be edited here (Play URL differs — its URL
  is handed to the speaker, not fetched by soundtouch-web, so no SSRF).
- api.speak no longer sends serviceUrl.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Tobias Gesellchen
2026-05-31 22:35:31 +02:00
co-authored by Claude Opus 4.8
parent 382c68d2b6
commit 258cc6198f
4 changed files with 38 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/content/docs/reference/SPEAKER-ENDPOINT.md
+3 -3
View File
@@ -333,9 +333,9 @@ soundtouch-cli speaker tts-cloud \
--method speaker
```
Web UI: the TTS source view (and the Play URL view) include a "Say something…"
box. soundtouch-web proxies it to the service, so start it with `--service-url`
(or enter the service URL in the view).
Web UI: the TTS source view has a "Say something…" box. soundtouch-web proxies
it to the service, so it must be started with `--service-url` (the target is
server-configured, not entered in the browser, to avoid an SSRF proxy).
### Notes and limitations