github/Bose-SoundTouch
1
0
Fork 0
mirror of https://github.com/gesellix/Bose-SoundTouch.git synced 2026-08-18 08:36:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

sec5e: sanitize log-injection in client, discovery, testutils, cmd

Browse Source 
Fixes CodeQL go/log-injection alerts in the final batch of packages.

New logutil.go helpers: pkg/client, pkg/testutils/amazon,
pkg/testutils/spotify, cmd/soundtouch-service, cmd/soundtouch-web,
cmd/dummy-speaker, cmd/mdns-scanner.

pkg/discovery/logger.go: added sanitizeLog and a nil-safe
remoteAddrString helper to the existing file (alongside logVerbose).

Call sites wrapped across 11 files — device IDs, source types,
hostnames, IPs, interface names, URLs, service names, HTTP method/form
values, WebSocket URLs and payloads, TLS SNI names, remote addresses.

No behaviour change. golangci-lint and make check pass.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Tobias Gesellchen
2026-05-24 17:29:39 +02:00
co-authored by Claude Sonnet 4.6
parent 3d8e08d11a
commit dc8ec69c61
18 changed files with 185 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/client/logutil.go
+13
View File
@@ -0,0 +1,13 @@
package client
import "strings"
// sanitizeLog strips newline characters from s to prevent log-injection
// (CodeQL go/log-injection). Values from speakers, HTTP requests, and
// external APIs may contain attacker-controlled newlines.
func sanitizeLog(s string) string {
s = strings.ReplaceAll(s, "\n", `\n`)
s = strings.ReplaceAll(s, "\r", `\r`)
return s
}
pkg/client/websocket.go
+4 -4
View File
@@ -218,7 +218,7 @@ func (ws *WebSocketClient) connectWithConfig(config *WebSocketConfig) error {
Path: "/",
}
ws.logger.Printf("Connecting to %s", wsURL.String())
ws.logger.Printf("Connecting to %s", sanitizeLog(wsURL.String()))
// Create dialer with custom buffer sizes and "gabbo" protocol
dialer := websocket.Dialer{
@@ -245,7 +245,7 @@ func (ws *WebSocketClient) connectWithConfig(config *WebSocketConfig) error {
go ws.readLoop(config)
go ws.pingLoop(config)
ws.logger.Printf("Connected to %s", wsURL.String())
ws.logger.Printf("Connected to %s", sanitizeLog(wsURL.String()))
return nil
}
@@ -443,7 +443,7 @@ func (ws *WebSocketClient) handleSpecialMessage(data []byte) {
if err != nil {
ws.logger.Printf("Unknown special message type: %v", err)
ws.logger.Printf("Raw message: %s", string(data))
ws.logger.Printf("Raw message: %s", sanitizeLog(string(data)))
return
}
@@ -589,7 +589,7 @@ func (ws *WebSocketClient) PairWithAccount(accountID, userAuthToken string) erro
return fmt.Errorf("failed to marshal pairing request: %w", err)
}
ws.logger.Printf("Sending PairDeviceWithAccount for account %s", accountID)
ws.logger.Printf("Sending PairDeviceWithAccount for account %s", sanitizeLog(accountID))
return ws.SendMessage(data)
}