mirror of
https://github.com/gesellix/Bose-SoundTouch.git
synced 2026-08-19 00:56:16 +00:00
Tobias GesellchenandClaude Sonnet 4.6
370c56ec9e
Two alerts at proxy.go:87: - go/clear-text-logging (alert 294): the UnsafeLogCredentialHeaders escape hatch allowed credential-bearing headers (Authorization, Cookie, …) to reach log.Printf in plaintext when LOG_PROXY_CREDENTIALS=true. CodeQL traces the taint regardless of the conditional. Remove UnsafeLogCredentialHeaders entirely. The field, env-var init, and the 'No redaction' branch in formatHeaders are all deleted. Credentials are now always redacted unconditionally. Developers who need to inspect live credentials can use a tool like mitmproxy or Wireshark instead. - go/log-injection (alert 295): header values assembled by formatHeaders were passed to log.Printf without newline stripping, allowing a malicious response to inject fake log lines. Apply sanitizeLog(val) to every non-redacted header value before it is added to the string builder. Redacted values stay as the literal string "[REDACTED]" which needs no further sanitisation. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>