Tobias GesellchenandClaude Sonnet 4.6 36943044dc fix(security): validate account ID in HandleMargeProviderSettings ...

The handler used chi.URLParam("account") directly without the
validatePathID guard present on every other account-parameter handler
in the file. CodeQL traced the raw URL param through
marge.ProviderSettingsToXML into the response body (go/reflected-xss,
alert 75).

Add the standard two-line guard identical to HandleMargeAddDevice,
HandleMargeUpdateDevice, and the rest of the family.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-25 10:30:42 +02:00

..

static

refactor(ding): synthesise on demand instead of vendoring the WAV

2026-05-19 23:20:40 +02:00

testdata/issue285

test: sweep example data in test files to RFC-5737 + placeholders

2026-05-17 22:05:13 +02:00

web

fix(web): update stale Jekyll doc URLs in admin UI

2026-05-24 17:33:09 +02:00

bmx_registry_test.go

test(handlers): use deterministic IP in BMX registry test

2026-05-14 14:49:23 +02:00

bridge_test.go

Fix data race in TestSpotifyBridge

2026-04-06 21:15:15 +02:00

dns_settings_test.go

feat(service): validate server_url and surface resolved DNS intercept IP

2026-05-14 14:49:23 +02:00

docs_consistency_test.go

docs: migrate Jekyll site to Hugo + Hextra

2026-05-24 13:30:36 +02:00

handlers_account_mgmt_test.go

Improve source sync by adding deduction of known source IDs (#167)

2026-04-17 18:50:51 +02:00

handlers_account_mgmt.go

sec5a: sanitize log-injection in pkg/service/handlers

2026-05-24 16:20:25 +02:00

handlers_alexa.go

sec5a: sanitize log-injection in pkg/service/handlers

2026-05-24 16:20:25 +02:00

handlers_bmx_custom.go

refactor(handlers): split handlers_bmx.go per BMX service

2026-05-17 15:05:39 +02:00

handlers_bmx_orion.go

sec5a: sanitize log-injection in pkg/service/handlers

2026-05-24 16:20:25 +02:00

handlers_bmx_registry_availability_test.go

Add /bmx/registry/v1/servicesAvailability

2026-04-05 00:55:40 +02:00

handlers_bmx_report_test.go

remove: mirror middleware and parity comparison with Bose cloud

2026-05-17 21:53:33 +02:00

handlers_bmx_siriusxm.go

sec5a: sanitize log-injection in pkg/service/handlers

2026-05-24 16:20:25 +02:00

handlers_bmx_test.go

remove: mirror middleware and parity comparison with Bose cloud

2026-05-17 21:53:33 +02:00

handlers_bmx_tunein_test.go

fix(bmx): relax TuneIn + Orion Authorization gate, log instead

2026-05-17 15:05:39 +02:00

handlers_bmx_tunein.go

sec5a: sanitize log-injection in pkg/service/handlers

2026-05-24 16:20:25 +02:00

handlers_bmx.go

fix(lint): add staticcheck-native suppressions for known-good warnings

2026-05-24 14:49:13 +02:00

handlers_catchall_test.go

refactor(handlers): rename proxy-era leftovers to match public names

2026-05-17 21:53:33 +02:00

handlers_catchall.go

sec5a: sanitize log-injection in pkg/service/handlers

2026-05-24 16:20:25 +02:00

handlers_device_summary_test.go

feat(health): aggregate device-summary panel on Devices tab

2026-05-19 23:20:40 +02:00

handlers_device_summary.go

feat(health): aggregate device-summary panel on Devices tab

2026-05-19 23:20:40 +02:00

handlers_ding_test.go

fix(ding): clamp sample rate against int -> uint32 truncation

2026-05-19 23:20:40 +02:00

handlers_ding.go

fix(ding): clamp sample rate against int -> uint32 truncation

2026-05-19 23:20:40 +02:00

handlers_docs.go

fix(security): close go/path-injection alerts via os.Root containment

2026-05-10 15:18:24 +02:00

handlers_etag_account_test.go

Fix ETag for account-level endpoints (#177)

2026-04-20 21:09:00 +02:00

handlers_etag_test.go

fix(lint): add staticcheck-native suppressions for known-good warnings

2026-05-24 14:49:13 +02:00

handlers_events_test.go

Merge existing device info in SaveDeviceInfo to preserve name on power-on

2026-03-17 22:59:20 +01:00

handlers_events.go

Fix golangci-lint issues: error checking, JSON encoding, variable shadowing, and code structure

2026-02-07 22:36:50 +01:00

handlers_export_test.go

feat(export): encrypted diagnostic report for issue reporting

2026-05-21 20:02:57 +02:00

handlers_export.go

sec5a: sanitize log-injection in pkg/service/handlers

2026-05-24 16:20:25 +02:00

handlers_health_checks_test.go

feat(service): add Health tab with datastore checks and quick fixes

2026-05-19 20:00:16 +02:00

handlers_health_checks.go

feat(service): add Health tab with datastore checks and quick fixes

2026-05-19 20:00:16 +02:00

handlers_health_test.go

Merge existing device info in SaveDeviceInfo to preserve name on power-on

2026-03-17 22:59:20 +01:00

handlers_health.go

feat(service): expose build version on GET / mirroring /health

2026-05-17 19:14:05 +02:00

handlers_logs_test.go

feat(service): add Logs tab streaming the live stderr trace

2026-05-19 20:12:25 +02:00

handlers_logs.go

feat(service): add Logs tab streaming the live stderr trace

2026-05-19 20:12:25 +02:00

handlers_marge_stockholm_test.go

feat: implement Stockholm-related cloud API emulation - Added handlers for Stockholm app events (/v1/stapp, /v1/scmudc) - Implemented account profile, password management, and device settings endpoints - Added Go models for new API responses and requests - Created docs/reference/CLOUD-API.md and updated SUMMARY.md - Added comprehensive unit tests for all new handlers - Updated ueberboese-api.yaml with new endpoints and schemas

2026-02-15 20:20:47 +01:00

handlers_marge_test.go

test: sweep example data in test files to RFC-5737 + placeholders

2026-05-17 22:05:13 +02:00

handlers_marge.go

fix(security): validate account ID in HandleMargeProviderSettings

2026-05-25 10:30:42 +02:00

handlers_media_test.go

feat: tighter discovery filter + UX cleanups (#269, #345, #355, #359)

2026-05-22 21:15:34 +02:00

handlers_media.go

feat: tighter discovery filter + UX cleanups (#269, #345, #355, #359)

2026-05-22 21:15:34 +02:00

handlers_mgmt_test.go

feat(spotify): improve Spotify registration flow and speaker notification

2026-04-06 22:39:30 +02:00

handlers_mgmt.go

sec5a: sanitize log-injection in pkg/service/handlers

2026-05-24 16:20:25 +02:00

handlers_oauth_test.go

remove: proxy forwarding to Bose upstream

2026-05-17 21:53:33 +02:00

handlers_oauth.go

sec5a: sanitize log-injection in pkg/service/handlers

2026-05-24 16:20:25 +02:00

handlers_pairing.go

feat(health): operator-confirmable QuickFix to complete speaker pairing (#329)

2026-05-20 22:44:57 +02:00

handlers_peer_probe.go

feat(service): add passive peer-reachability probe handler

2026-05-11 20:31:24 +02:00

handlers_setup_test.go

test: sweep example data in test files to RFC-5737 + placeholders

2026-05-17 22:05:13 +02:00

handlers_setup.go

feat: add source removal — health check, API endpoint, and CLI commands

2026-05-23 22:45:15 +02:00

handlers_stats_test.go

Merge existing device info in SaveDeviceInfo to preserve name on power-on

2026-03-17 22:59:20 +01:00

handlers_stats.go

feat: implement Stockholm-related cloud API emulation - Added handlers for Stockholm app events (/v1/stapp, /v1/scmudc) - Implemented account profile, password management, and device settings endpoints - Added Go models for new API responses and requests - Created docs/reference/CLOUD-API.md and updated SUMMARY.md - Added comprehensive unit tests for all new handlers - Updated ueberboese-api.yaml with new endpoints and schemas

2026-02-15 20:20:47 +01:00

handlers_tls_hosts_fix_test.go

feat(tls): persist TLSExtraHosts + Settings UI + speaker_marge_url QuickFix

2026-05-22 20:32:44 +02:00

handlers_tls_hosts_fix.go

feat(tls): persist TLSExtraHosts + Settings UI + speaker_marge_url QuickFix

2026-05-22 20:32:44 +02:00

interactions_test.go

remove: mirror middleware and parity comparison with Bose cloud

2026-05-17 21:53:33 +02:00

issue218_regression_test.go

fix(bmx): restore the Authorization gate on /core02/.../orion/station

2026-05-15 14:13:24 +02:00

issue285_regression_test.go

test: sweep example data in test files to RFC-5737 + placeholders

2026-05-17 22:05:13 +02:00

logutil.go

sec5b: sanitize log-injection in pkg/service/datastore and pkg/service/marge

2026-05-24 16:36:24 +02:00

mac_discovery_integration_test.go

fix(handlers): remove stale account entry when MoveDevice target dir exists

2026-05-24 10:23:38 +02:00

mac_mapping_integration_test.go

fix(lint): add staticcheck-native suppressions for known-good warnings

2026-05-24 14:49:13 +02:00

main_test.go

refactor: rename /setup/proxy-settings → /setup/logging-settings

2026-05-17 21:53:33 +02:00

middleware_peer_observer.go

feat(service): add passive peer-reachability probe handler

2026-05-11 20:31:24 +02:00

middleware_realip_test.go

test: sweep example data in test files to RFC-5737 + placeholders

2026-05-17 22:05:13 +02:00

middleware_realip.go

feat(handlers): proxy-aware RemoteAddr via opt-in TrustForwardedHeaders

2026-05-10 14:40:15 +02:00

migration_options_test.go

feat(handlers): allow per-field telnet URL keys in migration options

2026-05-11 00:37:11 +02:00

migration_options.go

feat(handlers): allow per-field telnet URL keys in migration options

2026-05-11 00:37:11 +02:00

origin_middleware.go

sec5a: sanitize log-injection in pkg/service/handlers

2026-05-24 16:20:25 +02:00

parity_mismatch_repro_test.go

Add/improve e2e test cases

2026-04-04 18:53:59 +02:00

parity_mismatch_repro_v2_test.go

feat: improve Bose SoundTouch parity, Spotify integration, and data reliability (#138)

2026-04-01 21:55:52 +02:00

parity_regression_test.go

Improve parity with upstream (#155)

2026-04-07 14:44:05 +02:00

peer_observer_test.go

test: sweep example data in test files to RFC-5737 + placeholders

2026-05-17 22:05:13 +02:00

peer_observer.go

feat(service): add passive peer-reachability probe handler

2026-05-11 20:31:24 +02:00

preflight_test.go

feat(preflight): skip :443 check in HTTP-only deployments + OUTPUT-chain caveat

2026-05-22 20:32:44 +02:00

preflight.go

feat(preflight): skip :443 check in HTTP-only deployments + OUTPUT-chain caveat

2026-05-22 20:32:44 +02:00

prime_spotify_test.go

feat(spotify): wire preset storage end-to-end via server-centric priming (#302)

2026-05-16 22:47:57 +02:00

recent_parity_test.go

Add/improve e2e test cases

2026-04-04 18:53:59 +02:00

recorder_middleware.go

remove: mirror middleware and parity comparison with Bose cloud

2026-05-17 21:53:33 +02:00

scmudc_enricher.go

Decode SCMUDC event details (#97)

2026-03-05 23:19:39 +01:00

server_merge_test.go

test: sweep example data in test files to RFC-5737 + placeholders

2026-05-17 22:05:13 +02:00

server.go

sec5a: sanitize log-injection in pkg/service/handlers

2026-05-24 16:20:25 +02:00

shortcut_middleware.go

Add configurable shortcuts and log them on startup

2026-02-15 00:27:25 +01:00

snapshot_middleware_test.go

Improve parity with upstream Bose services

2026-02-26 21:08:14 +01:00

snapshot_middleware.go

Improve parity with upstream Bose services

2026-02-26 21:08:14 +01:00

spotify_addition_test.go

feat: improve Bose SoundTouch parity, Spotify integration, and data reliability (#138)

2026-04-01 21:55:52 +02:00