Tobias GesellchenandClaude Opus 4.8 d413bf60ab fix(tts): resolve speak target to a known device IP (SSRF, CodeQL 305) ...

HandleTTSSpeak passed the request's `host` straight to
client.NewClientFromHost, so the resolved value flowed into the client's
baseURL and the outbound request (client.go post -> httpClient.Do) — a
caller could point the service at an arbitrary host:8090 (SSRF).

resolveTTSHost now always returns an IP looked up from the datastore:
match by deviceId, or by host equal to a known device's IP, and return
that stored IPAddress (never the caller-supplied string). Unknown
hosts/devices are rejected. This both mitigates the SSRF and breaks the
tainted data flow. Adds regression cases for unknown host/device.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-05-31 22:35:31 +02:00

..

amazon

sec8: refactor zeroconf API to (host, port string) to close request-forgery alerts

2026-05-25 13:14:56 +02:00

bmx

fix(service): forward all TuneIn stream candidates for failover

2026-05-30 21:03:00 +02:00

certmanager

sec4: fix unhandled writable file close; ignore CODE-SCANNING-NOTES.md

2026-05-24 15:52:35 +02:00

constants

refactor(speaker): introduce pkg/speaker leaf for shared protocol constants

2026-05-11 23:18:08 +02:00

datastore

feat(tts): configure Google Cloud TTS from the settings UI; group integrations into collapsible panels

2026-05-31 22:35:31 +02:00

ding

fix(health): skip fetchHealth re-render for non-resolving quick fixes

2026-05-27 21:20:58 +02:00

export

feat(export): encrypted diagnostic report for issue reporting

2026-05-21 20:02:57 +02:00

handlers

fix(tts): resolve speak target to a known device IP (SSRF, CodeQL 305)

2026-05-31 22:35:31 +02:00

health

fix(health): skip fetchHealth re-render for non-resolving quick fixes

2026-05-27 21:20:58 +02:00

logbuf

feat(service): add Logs tab streaming the live stderr trace

2026-05-19 20:12:25 +02:00

marge

fix(marge): never persist or serve sources without a resolvable provider id

2026-05-30 23:33:19 +02:00

proxy

sec8: move lgtm annotation above log.Printf to suppress CodeQL alert #294

2026-05-25 20:06:36 +02:00

setup

fix(setup): seed audionotification host(s) into /etc/hosts for /speaker TTS

2026-05-31 22:35:31 +02:00

soundtouchweb

docs(web): trim the Play URL aside from the TTS view's SSRF note

2026-05-31 22:35:31 +02:00

spotify

sec8: refactor zeroconf API to (host, port string) to close request-forgery alerts

2026-05-25 13:14:56 +02:00

stations

feat(cli): service-side station search for TuneIn + Radio Browser

2026-05-30 20:53:40 +02:00

stockholm

fix(lint): sec6/sec7 post-pass — static.go Close + remove unused sanitizeErr

2026-05-25 11:28:26 +02:00

testing/fakespeaker

fix(setup): fire <sourcesUpdated/> after data sync to recover post-factory-reset sources

2026-05-15 16:25:07 +02:00

tts

fix(tts): play via LOCAL_INTERNET_RADIO; accept app_key at /v1/auth

2026-05-31 22:35:31 +02:00

zeroconf

sec8: validate zeroconf port to break CodeQL taint chain (alerts 134/135/136)

2026-05-25 21:17:57 +02:00