mirror of
https://github.com/gesellix/Bose-SoundTouch.git
synced 2026-08-19 00:56:16 +00:00
Tobias GesellchenandClaude Opus 4.7
fb75c8b1f3
CodeQL alerts #121, #122, #123 (go/request-forgery) flagged the three client.Get / client.PostForm sites in pkg/service/zeroconf/zeroconf.go that build their request URL by string-concatenating the caller-supplied zcBaseURL with "?action=…". The base URL ultimately originates from a device-pairing payload that the speaker pushes to us, so unvalidated input could redirect outbound HTTP requests to arbitrary hosts (server- side request forgery). Add validateZcBaseURL which: * parses zcBaseURL via net/url so the scheme and host are first-class values rather than substrings, * requires the scheme to be http or https, * rejects literal IP hosts that aren't loopback / RFC1918 private / link-local — those are the only places a real SoundTouch speaker can live on a local network, and a global IP would be an obvious exfiltration target, * leaves hostname-style hosts (e.g. mDNS *.local) accepted: name resolution itself is a separate trust boundary on the local segment. A small withAction helper builds the per-call URL from the validated base URL via url.Values rather than string concatenation, which CodeQL recognises as a non-tainted construction. GetInfo, PushCredentials and pushSimplifiedToken each call validateZcBaseURL up-front so all three CodeQL alerts close in a single pass. PushCredentials also re-validates even though it then calls GetInfo (which validates again) so the fallback to pushSimplifiedToken on getInfo failure is also gated. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>