Bose-SoundTouch

github/Bose-SoundTouch

Fork 0

mirror of https://github.com/gesellix/Bose-SoundTouch.git synced 2026-09-07 15:07:17 +00:00

Files

T

History

Tobias GesellchenandClaude Sonnet 5 14437fd568 fix(example-dlna-server): sanitize logged request values

CodeQL alert 313 (go/log-injection). The access-log middleware logged
r.URL.Path and SOAP-body-derived objectID/browseFlag verbatim, without
stripping newlines -- an attacker-controlled request could inject fake
log lines or control characters. Add the same sanitizeLog helper this
repo already uses in ~18 other packages for exactly this class of
finding.

Alert 312 (go/reflected-xss, same file/area) was investigated and left
open deliberately: objectID is only ever used as a lookup key in
pkg/dlna/dlnatest, never echoed into the response, and every actual
output field goes through xmlEsc/xmlAttr (encoding/xml.EscapeText)
before being written -- looks like a CodeQL false positive rather than
a real gap, but not dismissing it yet per discussion.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-08-29 23:19:32 +02:00

debug-consolidation

refactor: reorganize device directories to use true deviceId from /info endpoint

2026-02-24 21:45:40 +01:00

dummy-speaker

sec5e: sanitize log-injection in client, discovery, testutils, cmd

2026-05-24 17:29:39 +02:00

example-dlna-server

fix(example-dlna-server): sanitize logged request values

2026-08-29 23:19:32 +02:00

example-mdns

Fix SSDP discovery and enhance device discovery consistency