mirror of
https://github.com/gesellix/Bose-SoundTouch.git
synced 2026-08-19 00:56:16 +00:00
Tobias GesellchenandClaude Sonnet 4.6
3d8e08d11a
Fixes CodeQL go/log-injection alerts in three packages. Adds logutil.go with a package-private sanitizeLog helper to each. pkg/service/soundtouchweb/discovery.go (2 call sites): - host, source (device fetch failure) - source, info.Name, info.Type, host (device added) pkg/service/soundtouchweb/websocket.go (9 call sites): - deviceID across connect/disconnect/upgrade/read/ping/status messages pkg/service/stockholm/bridge.go (2 call sites): - method, clientID (dispatch trace) - clientID, msg (log bridge method) pkg/service/stockholm/discovery.go (2 call sites): - host (fetch failure) - host, info.MargeAccountUUID, expectedAccountID (skipping device) pkg/service/stockholm/static.go (1 call site): - r.URL.Path (path-traversal rejection) pkg/service/zeroconf/zeroconf.go (2 call sites): - username (logAddUserNoOp) - username, server, ct, cl, bodySummary (logAddUserFailure) No behaviour change. golangci-lint and make check pass. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
14 lines
366 B
Go
14 lines
366 B
Go
package zeroconf
|
|
|
|
import "strings"
|
|
|
|
// sanitizeLog strips newline characters from s to prevent log-injection
|
|
// (CodeQL go/log-injection). Values from speakers, HTTP requests, and
|
|
// external APIs may contain attacker-controlled newlines.
|
|
func sanitizeLog(s string) string {
|
|
s = strings.ReplaceAll(s, "\n", `\n`)
|
|
s = strings.ReplaceAll(s, "\r", `\r`)
|
|
|
|
return s
|
|
}
|