mirror of
https://github.com/gesellix/Bose-SoundTouch.git
synced 2026-09-07 15:07:17 +00:00
Tobias GesellchenandClaude Sonnet 5
14437fd568
CodeQL alert 313 (go/log-injection). The access-log middleware logged r.URL.Path and SOAP-body-derived objectID/browseFlag verbatim, without stripping newlines -- an attacker-controlled request could inject fake log lines or control characters. Add the same sanitizeLog helper this repo already uses in ~18 other packages for exactly this class of finding. Alert 312 (go/reflected-xss, same file/area) was investigated and left open deliberately: objectID is only ever used as a lookup key in pkg/dlna/dlnatest, never echoed into the response, and every actual output field goes through xmlEsc/xmlAttr (encoding/xml.EscapeText) before being written -- looks like a CodeQL false positive rather than a real gap, but not dismissing it yet per discussion. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
14 lines
333 B
Go
14 lines
333 B
Go
package main
|
|
|
|
import "strings"
|
|
|
|
// sanitizeLog strips newline characters from s to prevent log-injection
|
|
// (CodeQL go/log-injection). Values from HTTP requests may contain
|
|
// attacker-controlled newlines.
|
|
func sanitizeLog(s string) string {
|
|
s = strings.ReplaceAll(s, "\n", `\n`)
|
|
s = strings.ReplaceAll(s, "\r", `\r`)
|
|
|
|
return s
|
|
}
|