mirror of
https://github.com/gesellix/Bose-SoundTouch.git
synced 2026-08-19 00:56:16 +00:00
Tobias GesellchenandClaude Opus 4.7
426232e699
CodeQL flagged five reflected-XSS sites where caller-supplied query parameters or path segments were concatenated into HTML responses without escaping: * handlers_mgmt.go:147 — Spotify oauth error landing page * handlers_mgmt.go:490 — Amazon oauth error landing page * handlers_docs.go:65 — <title> built from r.URL.Path * recorder_middleware.go:83, mirror_middleware.go:205 — passthrough Write()s carrying tainted bytes from the three sources above Wrap each user-controlled value in html.EscapeString before it lands in the HTML body. The escaped output covers the upstream sources so the middleware passthrough alerts close as well. For handlers_docs the rendered markdown (`output`) and sidebar are server-controlled (loaded from on-disk doc files) and intentionally contain HTML, so only the URL path is escaped — the documentation content itself still renders normally. Handler test suite passes; pre-existing TestDocsConsistency failure about untracked working-tree docs is unrelated. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>