github/Bose-SoundTouch
1
0
Fork 0
mirror of https://github.com/gesellix/Bose-SoundTouch.git synced 2026-08-19 00:56:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): validate account ID in HandleMargeProviderSettings

Browse Source 
The handler used chi.URLParam("account") directly without the
validatePathID guard present on every other account-parameter handler
in the file. CodeQL traced the raw URL param through
marge.ProviderSettingsToXML into the response body (go/reflected-xss,
alert 75).

Add the standard two-line guard identical to HandleMargeAddDevice,
HandleMargeUpdateDevice, and the rest of the family.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Tobias Gesellchen
2026-05-25 11:28:26 +02:00
co-authored by Claude Sonnet 4.6
parent 208d4f61d6
commit 806d1fc22c
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/service/handlers/handlers_marge.go
+4
View File
@@ -754,6 +754,10 @@ func (s *Server) HandleMargeAddSource(w http.ResponseWriter, r *http.Request) {
// HandleMargeProviderSettings returns Marge provider settings.
func (s *Server) HandleMargeProviderSettings(w http.ResponseWriter, r *http.Request) {
account := chi.URLParam(r, "account")
if !validatePathID(account) {
http.Error(w, "Invalid account ID", http.StatusBadRequest)
return
}
w.Header().Set("Content-Type", "application/vnd.bose.streaming-v1.2+xml")
_, _ = w.Write([]byte(marge.ProviderSettingsToXML(account)))