mirror of
https://github.com/gesellix/Bose-SoundTouch.git
synced 2026-08-14 14:46:13 +00:00
Tobias GesellchenandClaude Sonnet 4.6
1dba7646b4
Replace validateZcBaseURL(zcBaseURL string) with: - validateZcHost(host string) (net.IP, error) — validates literal IP - buildZcBase(ip net.IP, port string) *url.URL — builds URL with literal /zc path The key change: the URL path is now the string literal "/zc" everywhere, never derived from user input. CodeQL's go/request-forgery model traces taint through the Path field of a rebuilt URL; removing that field from the taint chain closes alerts 134, 135, 136. Public API changes: zeroconf.GetInfo(host, port string) zeroconf.PushCredentials(host, port, username, accessToken string) spotify.ZeroConfGetInfo(host, port string) spotify.PushSpotifyCredentials(host, port, username, accessToken string) amazon.PushAmazonCredentials(host, port, username, accessToken string) Callers in handlers/server.go already held host+port separately via net.SplitHostPort; the zcURL construction is removed. Tests updated throughout; TestValidateZcBaseURL renamed to TestValidateZcHost and TestBuildZcBase added for the new helpers. Closes CodeQL alerts 134, 135, 136 (go/request-forgery). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
25 lines
1.1 KiB
Go
25 lines
1.1 KiB
Go
package spotify
|
|
|
|
import "github.com/gesellix/bose-soundtouch/pkg/service/zeroconf"
|
|
|
|
// ErrAddUserNoOp re-exports zeroconf.ErrAddUserNoOp so callers in the spotify
|
|
// package don't need a direct dependency on the zeroconf package to recognise
|
|
// the benign-no-op sentinel.
|
|
var ErrAddUserNoOp = zeroconf.ErrAddUserNoOp
|
|
|
|
// ZeroConfGetInfo fetches the speaker's DH public key via GET ?action=getInfo.
|
|
// host must be a literal private-network IP address.
|
|
// port is the ZeroConf port (typically "8200"); pass "" to omit it from the URL.
|
|
func ZeroConfGetInfo(host, port string) ([]byte, error) {
|
|
return zeroconf.GetInfo(host, port)
|
|
}
|
|
|
|
// PushSpotifyCredentials pushes Spotify credentials to a speaker using the full
|
|
// ZeroConf DH key exchange protocol. Falls back to simplified token push if
|
|
// the speaker does not support DH (older firmware).
|
|
// host must be a literal private-network IP address.
|
|
// port is the ZeroConf port (typically "8200"); pass "" to omit it from the URL.
|
|
func PushSpotifyCredentials(host, port, username, accessToken string) error {
|
|
return zeroconf.PushCredentials(host, port, username, accessToken)
|
|
}
|