Tobias GesellchenandClaude Opus 4.8 258cc6198f fix(web): stop TTS proxy from using a browser-supplied service URL (SSRF) ...

CodeQL flagged "uncontrolled data used in network request": the
soundtouch-web TTS proxy built its outbound request URL from the
client-supplied serviceUrl, letting any LAN caller use the endpoint as an
SSRF proxy. The proxy target must be the operator-configured --service-url.

- handler: use only app.ServiceURL; drop the client-supplied serviceUrl
  field and fallback.
- web TTS view: show the configured service URL read-only with an
  explanation of why it can't be edited here (Play URL differs — its URL
  is handed to the speaker, not fetched by soundtouch-web, so no SSRF).
- api.speak no longer sends serviceUrl.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-05-31 22:35:31 +02:00

..

static

fix(web): stop TTS proxy from using a browser-supplied service URL (SSRF)

2026-05-31 22:35:31 +02:00

webtypes

feat: Add RadioBrowser integration alongside TuneIn support

2026-05-18 22:34:26 +02:00

discovery.go

fix(web): stabilise speaker WebSocket connection and sync stale now-playing

2026-05-30 10:57:14 +02:00

embed.go

feat(soundtouch-web): swap vanilla Bootstrap UI for Preact+htm SPA

2026-05-18 22:34:26 +02:00

handler_test.go

fix(web): strip placeholder SourceAccount before replaying recents

2026-05-23 15:03:04 +02:00

handler.go

fix(tts): move TTS endpoints from /mgmt to /setup (no Basic Auth)

2026-05-31 22:35:31 +02:00

handlers_tts.go

fix(web): stop TTS proxy from using a browser-supplied service URL (SSRF)

2026-05-31 22:35:31 +02:00

logutil.go

sec5d: sanitize log-injection in soundtouchweb, stockholm, zeroconf

2026-05-24 16:52:53 +02:00

mount.go

fix(tts): move TTS endpoints from /mgmt to /setup (no Basic Auth)

2026-05-31 22:35:31 +02:00

registry_test.go

refactor(soundtouch-web): relocate handlers/webtypes to pkg/service/soundtouchweb

2026-05-18 22:34:26 +02:00

websocket.go

fix(web): stabilise speaker WebSocket connection and sync stale now-playing

2026-05-30 10:57:14 +02:00