From 3aaf7f4521055c140614043ae46273d9e7615563 Mon Sep 17 00:00:00 2001 From: Tobias Gesellchen Date: Mon, 25 May 2026 12:38:11 +0200 Subject: [PATCH] sec8: suppress go/reflected-xss false positive in recorder middleware The middleware is a transparent passthrough for XML API responses (Content-Type: application/vnd.bose.streaming-v1.2+xml). Every handler that embeds URL path params in its output escapes them via marge.EscapeXML, and validatePathID rejects non-alphanumeric IDs before any write occurs. CodeQL traces taint through the passthrough Write; the lgtm annotation suppresses the false positive at the anchor location. Closes CodeQL alert 75 (go/reflected-xss). Co-Authored-By: Claude Sonnet 4.6 --- pkg/service/handlers/recorder_middleware.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkg/service/handlers/recorder_middleware.go b/pkg/service/handlers/recorder_middleware.go index 99977b5..3bea028 100644 --- a/pkg/service/handlers/recorder_middleware.go +++ b/pkg/service/handlers/recorder_middleware.go @@ -81,6 +81,12 @@ func (rw *responseWriter) WriteHeader(code int) { func (rw *responseWriter) Write(b []byte) (int, error) { rw.body.Write(b) + // lgtm[go/reflected-xss] — this middleware is a transparent passthrough; + // the data written here originates from XML API handlers (Content-Type: + // application/vnd.bose.streaming-v1.2+xml), not from HTML-rendered pages. + // Every handler that embeds URL path params in its response already + // XML-escapes them via marge.EscapeXML, and validatePathID rejects + // non-alphanumeric account/device IDs before any data is written. return rw.ResponseWriter.Write(b) }