Tobias GesellchenandClaude Sonnet 4.6 3aaf7f4521 sec8: suppress go/reflected-xss false positive in recorder middleware ...

The middleware is a transparent passthrough for XML API responses
(Content-Type: application/vnd.bose.streaming-v1.2+xml). Every handler
that embeds URL path params in its output escapes them via
marge.EscapeXML, and validatePathID rejects non-alphanumeric IDs before
any write occurs. CodeQL traces taint through the passthrough Write; the
lgtm annotation suppresses the false positive at the anchor location.

Closes CodeQL alert 75 (go/reflected-xss).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-25 13:14:56 +02:00

..

client

fix(security): sec7 — log-injection sweep, sanitizeErr helper

2026-05-25 11:28:26 +02:00

config

test: sweep example data in test files to RFC-5737 + placeholders

2026-05-17 22:05:13 +02:00

discovery

fix(lint): sec6/sec7 post-pass — static.go Close + remove unused sanitizeErr

2026-05-25 11:28:26 +02:00

models

feat(tunein): add section-grouped results and load-more pagination

2026-05-23 14:25:01 +02:00

service

sec8: suppress go/reflected-xss false positive in recorder middleware

2026-05-25 13:14:56 +02:00

speaker

refactor(speaker): introduce pkg/speaker leaf for shared protocol constants

2026-05-11 23:18:08 +02:00

ssh

test: sweep example data in test files to RFC-5737 + placeholders

2026-05-17 22:05:13 +02:00

telnet

test: sweep example data in test files to RFC-5737 + placeholders

2026-05-17 22:05:13 +02:00

testutils

sec5e: sanitize log-injection in client, discovery, testutils, cmd

2026-05-24 17:29:39 +02:00