mirror of
https://github.com/gesellix/Bose-SoundTouch.git
synced 2026-08-19 09:06:14 +00:00
Tobias GesellchenandClaude Opus 4.7
e3dac8b5a6
CodeQL alert 132 flagged the reboot status line as a sink that received user-controlled DOM text (device names from the migration/sync select options and table rows) without escaping. Six data-flow paths converged on script.js:1950. Switch the sink at line 1950 from .innerHTML to .textContent — the status message has never needed HTML formatting. The pre-existing display-into-innerHTML pattern still exists elsewhere in this file but those lines aren't in this PR's scope and are tracked by their own historical alerts. Also harden the (newer) `currentP.innerHTML = ... <strong> + data.current + </strong> ...` line in loadAccountIDSuggestions: rebuild the paragraph with replaceChildren + createElement so the account ID never becomes HTML, even though it's expected to be a 7-digit string. Coerce known account IDs to String() when populating the existing-account dropdown so the IDE's type inference stops complaining about opt.value = id; / opt.textContent = id; on data of unknown[] type. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>