Bose-SoundTouch

mirror of https://github.com/gesellix/Bose-SoundTouch.git synced 2026-08-18 16:46:17 +00:00

Files

T

Tobias GesellchenandClaude Opus 4.8 258cc6198f fix(web): stop TTS proxy from using a browser-supplied service URL (SSRF)

CodeQL flagged "uncontrolled data used in network request": the
soundtouch-web TTS proxy built its outbound request URL from the
client-supplied serviceUrl, letting any LAN caller use the endpoint as an
SSRF proxy. The proxy target must be the operator-configured --service-url.

- handler: use only app.ServiceURL; drop the client-supplied serviceUrl
  field and fallback.
- web TTS view: show the configured service URL read-only with an
  explanation of why it can't be edited here (Play URL differs — its URL
  is handed to the speaker, not fetched by soundtouch-web, so no SSRF).
- api.speak no longer sends serviceUrl.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-05-31 22:35:31 +02:00

_includes

docs: render mermaid diagrams on the GitHub Pages site

2026-05-16 23:54:39 +02:00

archive

fix: repair three remaining dead links

2026-05-24 13:30:36 +02:00

assets/css

fix(docs): fix font 404 on GitHub Pages (../../fonts/ path in custom.css)

2026-05-26 23:19:04 +02:00

content

fix(web): stop TTS proxy from using a browser-supplied service URL (SSRF)