mirror of
https://github.com/gesellix/Bose-SoundTouch.git
synced 2026-08-19 17:16:16 +00:00
Tobias GesellchenandClaude Opus 4.7
648eedefde
CodeQL flagged 34 go/path-injection alerts across datastore.go, marge.go, recorder.go, handlers_docs.go and mirror_middleware.go. The existing defences (DataStore.safeJoin's post-join prefix check, handlers_docs's HasPrefix(filepath.Clean(...))) are functionally correct but sit downstream of the join, so CodeQL's interprocedural taint tracking treats every os.* sink that consumes them as still tainted. Move the validation up-front using filepath.IsLocal, which CodeQL recognises as a path-traversal sanitiser. IsLocal rejects absolute paths, ".." segments, and (on Windows) reserved device names — the same set the existing checks intended to block, just expressed in the shape the analyser understands. Changes: * DataStore.safeJoin (datastore.go) — pre-validates each non-empty element with filepath.IsLocal before joining. Existing post-join prefix check stays as belt-and-suspenders. ~30 of the 34 alerts flow through this helper. * Recorder (recorder.go) — adds a new (*Recorder).safeJoin method with the same sanitiser. getRecordingDir, DeleteSession, GetInteractionContent and ArchiveSession route through it; their signatures already returned error so plumbing it through is local. * HandleDocs (handlers_docs.go) — replaces the post-join HasPrefix check with an up-front filepath.IsLocal gate. * Mirror parity recorder (mirror_middleware.go) — also strips backslash separators (Windows) and gates the resulting filename component on filepath.IsLocal, falling back to "invalid" rather than letting malformed paths reach os.WriteFile. No behaviour change for legitimate inputs (account IDs, device IDs, session IDs, doc paths all satisfy IsLocal). Datastore and proxy test suites pass; handler suite's pre-existing TestDocsConsistency failure is unrelated. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>