mirror of
https://github.com/gesellix/Bose-SoundTouch.git
synced 2026-08-19 17:16:16 +00:00
Tobias GesellchenandClaude Opus 4.7
4507d82b4c
Two of the eight CodeQL alerts on PR #313 had clean, low-cost fixes: - go/clear-text-logging (#141, #142): the SiriusXM stub logged the raw Authorization header value at INFO. The header carries a long-lived bearer token (margeAuthToken) — capturing service logs would yield replayable credentials. Switch to logging only the boolean presence (`authPresent=%t`). - go/bad-redirect-check (#138): the Stockholm handler's bare-path redirect uses cfg.BasePath verbatim. basePath is operator-provided (CLI flag / STOCKHOLM_BASE_PATH env), not request input — but a value like "//evil.com" would still produce a scheme-relative redirect to an external host. Reject any leading-double-slash or embedded backslash at construction time so the redirect target can only ever be an absolute local path. The remaining CodeQL alerts are out of scope here: - go/request-forgery on proxy.go (#139, #140): the /api/http-proxy endpoint takes a user-provided url= parameter and fetches it by design — that's the whole point of the proxy. Mitigations already in place: isProxyLoop rejects self-references; the proxy is only reachable under a LAN trust model. - go/path-injection on static.go (#143, #144, #145): the path-traversal guard in resolveStaticFile (string-prefix check on absolute paths) is sound, but CodeQL doesn't trace it across the function boundary. A clearer refactor to filepath.Rel might silence the alert; deferred. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>