Bose-SoundTouch

github/Bose-SoundTouch

Fork 0

mirror of https://github.com/gesellix/Bose-SoundTouch.git synced 2026-09-07 15:07:17 +00:00

Files

T

History

Tobias GesellchenandClaude Sonnet 5 966214c5a0 fix(player): use hasOwnProperty for the device-status guard

CodeQL alert 318 (js/remote-property-injection). setDevices guarded
the status_update write with a plain "!prev[msg.deviceId]" truthy
check; a deviceId of "__proto__" or "constructor" resolves through
the prototype chain to a truthy value, so it would pass the guard
despite not being a real known device, letting the spread write a
bogus own-property (not actual prototype pollution -- computed keys
in object literals use [[DefineOwnProperty]], not the legacy __proto__
setter -- but still corrupts the rendered device list). Use
Object.prototype.hasOwnProperty.call for a real own-property check;
avoided Object.hasOwn (ES2022, Safari 15.4+) given #649's recent
Safari-15.0 compatibility work.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-08-29 23:19:32 +02:00

client

fix(models): surface DeviceError's name attribute, not just its message

2026-08-09 19:47:49 +02:00

config

test: sweep example data in test files to RFC-5737 + placeholders

2026-05-17 22:05:13 +02:00

discovery

fix(player,discovery): normalize uuid: prefix for STORED_MUSIC accounts; fill MediaServer.Address

2026-06-09 22:50:49 +02:00

dlna

feat(example-dlna-server): album art, real media via --media-dir, fix discovery, BrowseMetadata + access log