github/Bose-SoundTouch
1
0
Fork 0
mirror of https://github.com/gesellix/Bose-SoundTouch.git synced 2026-08-24 14:47:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

sec8: suppress go/reflected-xss false positive in recorder middleware

Browse Source 
The middleware is a transparent passthrough for XML API responses
(Content-Type: application/vnd.bose.streaming-v1.2+xml). Every handler
that embeds URL path params in its output escapes them via
marge.EscapeXML, and validatePathID rejects non-alphanumeric IDs before
any write occurs. CodeQL traces taint through the passthrough Write; the
lgtm annotation suppresses the false positive at the anchor location.

Closes CodeQL alert 75 (go/reflected-xss).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Tobias Gesellchen
2026-05-25 13:14:56 +02:00
co-authored by Claude Sonnet 4.6
parent f5ebe92d3c
commit 3aaf7f4521
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/service/handlers/recorder_middleware.go
+6
View File
@@ -81,6 +81,12 @@ func (rw *responseWriter) WriteHeader(code int) {
func (rw *responseWriter) Write(b []byte) (int, error) {
rw.body.Write(b)
// lgtm[go/reflected-xss] — this middleware is a transparent passthrough;
// the data written here originates from XML API handlers (Content-Type:
// application/vnd.bose.streaming-v1.2+xml), not from HTML-rendered pages.
// Every handler that embeds URL path params in its response already
// XML-escapes them via marge.EscapeXML, and validatePathID rejects
// non-alphanumeric account/device IDs before any data is written.
return rw.ResponseWriter.Write(b)
}