Tobias GesellchenandClaude Sonnet 4.6 1dba7646b4 sec8: refactor zeroconf API to (host, port string) to close request-forgery alerts ...

Replace validateZcBaseURL(zcBaseURL string) with:
  - validateZcHost(host string) (net.IP, error)  — validates literal IP
  - buildZcBase(ip net.IP, port string) *url.URL  — builds URL with literal /zc path

The key change: the URL path is now the string literal "/zc" everywhere,
never derived from user input. CodeQL's go/request-forgery model traces
taint through the Path field of a rebuilt URL; removing that field from
the taint chain closes alerts 134, 135, 136.

Public API changes:
  zeroconf.GetInfo(host, port string)
  zeroconf.PushCredentials(host, port, username, accessToken string)
  spotify.ZeroConfGetInfo(host, port string)
  spotify.PushSpotifyCredentials(host, port, username, accessToken string)
  amazon.PushAmazonCredentials(host, port, username, accessToken string)

Callers in handlers/server.go already held host+port separately via
net.SplitHostPort; the zcURL construction is removed.

Tests updated throughout; TestValidateZcBaseURL renamed to
TestValidateZcHost and TestBuildZcBase added for the new helpers.

Closes CodeQL alerts 134, 135, 136 (go/request-forgery).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-25 13:14:56 +02:00

..

service_test.go

feat: implement HandleBoseAmazonToken and wire amazonService into Server

2026-04-29 20:30:06 +02:00

service.go

docs(amazon): confirm amazon_music:access scope requires device client ID

2026-04-29 20:30:06 +02:00

zeroconf_test.go

sec8: refactor zeroconf API to (host, port string) to close request-forgery alerts

2026-05-25 13:14:56 +02:00

zeroconf.go

sec8: refactor zeroconf API to (host, port string) to close request-forgery alerts

2026-05-25 13:14:56 +02:00