github/Bose-SoundTouch
1
0
Fork 0
mirror of https://github.com/gesellix/Bose-SoundTouch.git synced 2026-08-24 14:47:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): close go/reflected-xss alerts via html.EscapeString

Browse Source 
CodeQL flagged five reflected-XSS sites where caller-supplied query
parameters or path segments were concatenated into HTML responses
without escaping:

* handlers_mgmt.go:147 — Spotify oauth error landing page
* handlers_mgmt.go:490 — Amazon oauth error landing page
* handlers_docs.go:65 — <title> built from r.URL.Path
* recorder_middleware.go:83, mirror_middleware.go:205 — passthrough
  Write()s carrying tainted bytes from the three sources above

Wrap each user-controlled value in html.EscapeString before it lands
in the HTML body. The escaped output covers the upstream sources so
the middleware passthrough alerts close as well.

For handlers_docs the rendered markdown (`output`) and sidebar are
server-controlled (loaded from on-disk doc files) and intentionally
contain HTML, so only the URL path is escaped — the documentation
content itself still renders normally.

Handler test suite passes; pre-existing TestDocsConsistency failure
about untracked working-tree docs is unrelated.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Tobias Gesellchen
2026-05-10 14:30:55 +02:00
co-authored by Claude Opus 4.7
parent 648eedefde
commit 426232e699
2 changed files with 15 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/service/handlers/handlers_docs.go
+8 -2
View File
@@ -2,6 +2,7 @@ package handlers
import (
"fmt"
"html"
"net/http"
"os"
"path/filepath"
@@ -56,7 +57,12 @@ func (s *Server) HandleDocs(w http.ResponseWriter, r *http.Request) {
// Render markdown to HTML
output := blackfriday.Run(content)
// Wrap in a documentation template with sidebar
// Wrap in a documentation template with sidebar. The user-supplied path
// is escaped before interpolation; the sidebar and rendered markdown
// output are server-controlled (loaded from local files) and may
// legitimately contain HTML.
titleSafe := html.EscapeString(path)
w.Header().Set("Content-Type", "text/html")
_, _ = fmt.Fprintf(w, `<!DOCTYPE html>
<html>
@@ -95,7 +101,7 @@ func (s *Server) HandleDocs(w http.ResponseWriter, r *http.Request) {
</div>
</div>
</body>
</html>`, path, sidebar, output)
</html>`, titleSafe, sidebar, output)
}
// fixSidebarLinks ensures that relative links in the SUMMARY.md (sidebar)
pkg/service/handlers/handlers_mgmt.go
+7 -2
View File
@@ -4,6 +4,7 @@ import (
"encoding/json"
"errors"
"fmt"
"html"
"io"
"log"
"net/http"
@@ -144,7 +145,9 @@ func (s *Server) HandleMgmtSpotifyCallback(w http.ResponseWriter, r *http.Reques
if errMsg := r.URL.Query().Get("error"); errMsg != "" {
w.Header().Set("Content-Type", "text/html")
w.WriteHeader(http.StatusBadRequest)
_, _ = w.Write([]byte(`<html><body><h1>Spotify Authorization Failed</h1><p>Error: ` + errMsg + `</p></body></html>`))
// html.EscapeString neutralises any HTML metacharacters in the
// caller-supplied error string before it lands in the response.
_, _ = w.Write([]byte(`<html><body><h1>Spotify Authorization Failed</h1><p>Error: ` + html.EscapeString(errMsg) + `</p></body></html>`))
return
}
@@ -487,7 +490,9 @@ func (s *Server) HandleMgmtAmazonCallback(w http.ResponseWriter, r *http.Request
if errMsg := r.URL.Query().Get("error"); errMsg != "" {
w.Header().Set("Content-Type", "text/html")
w.WriteHeader(http.StatusBadRequest)
_, _ = w.Write([]byte(`<html><body><h1>Amazon Authorization Failed</h1><p>Error: ` + errMsg + `</p></body></html>`))
// html.EscapeString neutralises any HTML metacharacters in the
// caller-supplied error string before it lands in the response.
_, _ = w.Write([]byte(`<html><body><h1>Amazon Authorization Failed</h1><p>Error: ` + html.EscapeString(errMsg) + `</p></body></html>`))
return
}