mirror of
https://github.com/gesellix/Bose-SoundTouch.git
synced 2026-08-14 14:46:13 +00:00
Tobias GesellchenandClaude Sonnet 4.6
1dba7646b4
Replace validateZcBaseURL(zcBaseURL string) with: - validateZcHost(host string) (net.IP, error) — validates literal IP - buildZcBase(ip net.IP, port string) *url.URL — builds URL with literal /zc path The key change: the URL path is now the string literal "/zc" everywhere, never derived from user input. CodeQL's go/request-forgery model traces taint through the Path field of a rebuilt URL; removing that field from the taint chain closes alerts 134, 135, 136. Public API changes: zeroconf.GetInfo(host, port string) zeroconf.PushCredentials(host, port, username, accessToken string) spotify.ZeroConfGetInfo(host, port string) spotify.PushSpotifyCredentials(host, port, username, accessToken string) amazon.PushAmazonCredentials(host, port, username, accessToken string) Callers in handlers/server.go already held host+port separately via net.SplitHostPort; the zcURL construction is removed. Tests updated throughout; TestValidateZcBaseURL renamed to TestValidateZcHost and TestBuildZcBase added for the new helpers. Closes CodeQL alerts 134, 135, 136 (go/request-forgery). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
17 lines
751 B
Go
17 lines
751 B
Go
package amazon
|
|
|
|
import "github.com/gesellix/bose-soundtouch/pkg/service/zeroconf"
|
|
|
|
// ErrAddUserNoOp re-exports zeroconf.ErrAddUserNoOp for callers that don't
|
|
// want a direct dependency on the zeroconf package.
|
|
var ErrAddUserNoOp = zeroconf.ErrAddUserNoOp
|
|
|
|
// PushAmazonCredentials pushes Amazon Music credentials to a speaker using the
|
|
// ZeroConf DH key exchange protocol. Falls back to simplified token push if
|
|
// the speaker does not support DH (older firmware).
|
|
// host must be a literal private-network IP address.
|
|
// port is the ZeroConf port (typically "8200"); pass "" to omit it from the URL.
|
|
func PushAmazonCredentials(host, port, username, accessToken string) error {
|
|
return zeroconf.PushCredentials(host, port, username, accessToken)
|
|
}
|