Tobias GesellchenandClaude Opus 4.8 d413bf60ab fix(tts): resolve speak target to a known device IP (SSRF, CodeQL 305) ...

HandleTTSSpeak passed the request's `host` straight to
client.NewClientFromHost, so the resolved value flowed into the client's
baseURL and the outbound request (client.go post -> httpClient.Do) — a
caller could point the service at an arbitrary host:8090 (SSRF).

resolveTTSHost now always returns an IP looked up from the datastore:
match by deviceId, or by host equal to a known device's IP, and return
that stored IPAddress (never the caller-supplied string). Unknown
hosts/devices are rejected. This both mitigates the SSRF and breaks the
tainted data flow. Adds regression cases for unknown host/device.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-05-31 22:35:31 +02:00

..

client

fix(web): stabilise speaker WebSocket connection and sync stale now-playing

2026-05-30 10:57:14 +02:00

config

…

discovery

fix(lint): sec6/sec7 post-pass — static.go Close + remove unused sanitizeErr

2026-05-25 11:28:26 +02:00

models

feat(tts): add Google Cloud Text-to-Speech via a pluggable provider

2026-05-31 22:35:31 +02:00

service

fix(tts): resolve speak target to a known device IP (SSRF, CodeQL 305)

2026-05-31 22:35:31 +02:00

speaker

…

ssh

sec8: document Run() invariant — command must never come from user HTTP input

2026-05-25 21:01:01 +02:00

telnet

…

testutils

sec5e: sanitize log-injection in client, discovery, testutils, cmd

2026-05-24 17:29:39 +02:00