mirror of
https://github.com/gesellix/Bose-SoundTouch.git
synced 2026-08-18 16:46:17 +00:00
Tobias GesellchenandClaude Sonnet 4.6
dc8ec69c61
Fixes CodeQL go/log-injection alerts in the final batch of packages. New logutil.go helpers: pkg/client, pkg/testutils/amazon, pkg/testutils/spotify, cmd/soundtouch-service, cmd/soundtouch-web, cmd/dummy-speaker, cmd/mdns-scanner. pkg/discovery/logger.go: added sanitizeLog and a nil-safe remoteAddrString helper to the existing file (alongside logVerbose). Call sites wrapped across 11 files — device IDs, source types, hostnames, IPs, interface names, URLs, service names, HTTP method/form values, WebSocket URLs and payloads, TLS SNI names, remote addresses. No behaviour change. golangci-lint and make check pass. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
14 lines
364 B
Go
14 lines
364 B
Go
package amazon
|
|
|
|
import "strings"
|
|
|
|
// sanitizeLog strips newline characters from s to prevent log-injection
|
|
// (CodeQL go/log-injection). Values from speakers, HTTP requests, and
|
|
// external APIs may contain attacker-controlled newlines.
|
|
func sanitizeLog(s string) string {
|
|
s = strings.ReplaceAll(s, "\n", `\n`)
|
|
s = strings.ReplaceAll(s, "\r", `\r`)
|
|
|
|
return s
|
|
}
|