From 806d1fc22cc40b3392b0af15e6f781b2d36c9ce1 Mon Sep 17 00:00:00 2001 From: Tobias Gesellchen Date: Mon, 25 May 2026 10:30:42 +0200 Subject: [PATCH] fix(security): validate account ID in HandleMargeProviderSettings The handler used chi.URLParam("account") directly without the validatePathID guard present on every other account-parameter handler in the file. CodeQL traced the raw URL param through marge.ProviderSettingsToXML into the response body (go/reflected-xss, alert 75). Add the standard two-line guard identical to HandleMargeAddDevice, HandleMargeUpdateDevice, and the rest of the family. Co-Authored-By: Claude Sonnet 4.6 --- pkg/service/handlers/handlers_marge.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkg/service/handlers/handlers_marge.go b/pkg/service/handlers/handlers_marge.go index 4fcf066..075db9e 100644 --- a/pkg/service/handlers/handlers_marge.go +++ b/pkg/service/handlers/handlers_marge.go @@ -754,6 +754,10 @@ func (s *Server) HandleMargeAddSource(w http.ResponseWriter, r *http.Request) { // HandleMargeProviderSettings returns Marge provider settings. func (s *Server) HandleMargeProviderSettings(w http.ResponseWriter, r *http.Request) { account := chi.URLParam(r, "account") + if !validatePathID(account) { + http.Error(w, "Invalid account ID", http.StatusBadRequest) + return + } w.Header().Set("Content-Type", "application/vnd.bose.streaming-v1.2+xml") _, _ = w.Write([]byte(marge.ProviderSettingsToXML(account)))