mirror of
https://github.com/gesellix/Bose-SoundTouch.git
synced 2026-08-19 00:56:16 +00:00
Tobias GesellchenandClaude Sonnet 4.6
3d5f8717d0
Fixes CodeQL go/log-injection alerts in the handlers package. Adds pkg/service/handlers/logutil.go with a package-private sanitizeLog helper that strips \n and \r from strings before they reach log call sites. Values from speakers, HTTP requests, and external APIs (device IDs, account IDs, IP addresses, speaker names, OAuth user IDs/emails, station IDs, URL paths, user-agent strings) may contain attacker-controlled newlines. Wraps all external-data string arguments across 12 files: handlers_account_mgmt.go, handlers_alexa.go, handlers_bmx_orion.go, handlers_bmx_siriusxm.go, handlers_bmx_tunein.go, handlers_catchall.go, handlers_export.go, handlers_marge.go, handlers_mgmt.go, handlers_oauth.go, origin_middleware.go, server.go. No behaviour change — purely a logging concern. make check passes. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
28 lines
667 B
Go
28 lines
667 B
Go
package handlers
|
|
|
|
import (
|
|
"log"
|
|
"net/http"
|
|
"time"
|
|
|
|
"github.com/go-chi/chi/v5/middleware"
|
|
)
|
|
|
|
// OriginMiddleware returns a middleware that logs whether the request was handled "self" or "upstream".
|
|
func (s *Server) OriginMiddleware(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
start := time.Now()
|
|
|
|
ww := middleware.NewWrapResponseWriter(w, r.ProtoMajor)
|
|
|
|
next.ServeHTTP(ww, r)
|
|
|
|
origin := "self"
|
|
if ww.Header().Get("X-Proxy-Origin") != "" {
|
|
origin = "upstream"
|
|
}
|
|
|
|
log.Printf("[LOG] %s %s | %d | %s | %v", r.Method, sanitizeLog(r.URL.Path), ww.Status(), origin, time.Since(start))
|
|
})
|
|
}
|