mirror of
https://github.com/gesellix/Bose-SoundTouch.git
synced 2026-08-20 17:46:19 +00:00
Tobias GesellchenandClaude Sonnet 4.6
bc52dd3067
Fixes CodeQL go/log-injection alerts in the proxy and setup packages. Adds logutil.go with a package-private sanitizeLog helper to each package. pkg/service/proxy/proxy.go (2 call sites): - LogRequest: r.URL.String(), bodyStr - LogResponse: r.Request.URL.String(), bodyStr pkg/service/proxy/recorder.go (1 call site): - save: task.path (derived from external URL path segments) pkg/service/setup/setup.go (7 call sites): - SyncDeviceData: deviceIP, info.Name, info.DeviceID, info.SerialNumber - syncPresets: deviceIP - notifySpeakerSourcesUpdated: deviceIP No behaviour change. golangci-lint and make check pass. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
14 lines
363 B
Go
14 lines
363 B
Go
package proxy
|
|
|
|
import "strings"
|
|
|
|
// sanitizeLog strips newline characters from s to prevent log-injection
|
|
// (CodeQL go/log-injection). Values from speakers, HTTP requests, and
|
|
// external APIs may contain attacker-controlled newlines.
|
|
func sanitizeLog(s string) string {
|
|
s = strings.ReplaceAll(s, "\n", `\n`)
|
|
s = strings.ReplaceAll(s, "\r", `\r`)
|
|
|
|
return s
|
|
}
|