Tobias GesellchenandClaude Sonnet 4.6 3d5f8717d0 sec5a: sanitize log-injection in pkg/service/handlers ...

Fixes CodeQL go/log-injection alerts in the handlers package.

Adds pkg/service/handlers/logutil.go with a package-private
sanitizeLog helper that strips \n and \r from strings before they
reach log call sites. Values from speakers, HTTP requests, and
external APIs (device IDs, account IDs, IP addresses, speaker names,
OAuth user IDs/emails, station IDs, URL paths, user-agent strings)
may contain attacker-controlled newlines.

Wraps all external-data string arguments across 12 files:
handlers_account_mgmt.go, handlers_alexa.go, handlers_bmx_orion.go,
handlers_bmx_siriusxm.go, handlers_bmx_tunein.go, handlers_catchall.go,
handlers_export.go, handlers_marge.go, handlers_mgmt.go,
handlers_oauth.go, origin_middleware.go, server.go.

No behaviour change — purely a logging concern. make check passes.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-24 16:20:25 +02:00

..

client

chore: sweep example LAN IPs to RFC-5737 in source and config files

2026-05-17 22:05:13 +02:00

config

test: sweep example data in test files to RFC-5737 + placeholders

2026-05-17 22:05:13 +02:00

discovery

feat(dns): auto-derive OAuth subdomain from serverURL hostname (#337)

2026-05-23 00:34:36 +02:00

models

feat(tunein): add section-grouped results and load-more pagination

2026-05-23 14:25:01 +02:00

service

sec5a: sanitize log-injection in pkg/service/handlers

2026-05-24 16:20:25 +02:00

speaker

refactor(speaker): introduce pkg/speaker leaf for shared protocol constants

2026-05-11 23:18:08 +02:00

ssh

test: sweep example data in test files to RFC-5737 + placeholders

2026-05-17 22:05:13 +02:00

telnet

test: sweep example data in test files to RFC-5737 + placeholders

2026-05-17 22:05:13 +02:00

testutils

feat: add Amazon LWA mock server (testutils + integration mocks)

2026-04-29 20:30:06 +02:00