Tobias GesellchenandClaude Opus 4.7
fbde4e136f
CodeQL re-fired three new go/request-forgery alerts (#134/135/136) on the lines my previous validateZcBaseURL refactor introduced. The previous validator accepted hostname-style hosts unchanged, so even though the IP-class check ran when applicable, u.String() at the call sites still emitted the original tainted host into the request URL — which is exactly what CodeQL traces. Tighten validateZcBaseURL to: * require the host to parse as a literal IP — DNS / mDNS hostnames are rejected (with a clear error explaining the caller should resolve to a private IP first); doing the lookup inside the validator would re-introduce the SSRF surface CodeQL is flagging, because malicious DNS could point a *.local name at a public host between the lookup and the request. * require that IP to be loopback / RFC1918 private / IPv4-or-IPv6 link-local. Anything else (global IPs in either family) is refused. * rebuild the returned *url.URL from validated components — scheme (already checked), the validated IP literal joined with the original port, and the original path. Pre-existing query/fragment are stripped so callers attach their own ?action= cleanly. CodeQL recognises this fresh-construction pattern as taint sanitisation. In practice this matches what SoundTouch speakers actually announce: IP-based zeroconf URLs at port 8200 against an LAN address. The existing PushCredentials_FullRoundTrip and FallbackOnGetInfoFailure tests already exercise the loopback path through httptest.NewServer and pass unchanged. Adds TestValidateZcBaseURL covering 17 inputs — 9 accept (loopback, private 10/172/192, link-local v4, IPv6 loopback, IPv6 link-local, strips query) and 8 reject (public IPv4, public IPv6, hostname, plain hostname, ftp/file schemes, empty host, unparseable) — to lock the new contract in. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Bose SoundTouch Toolkit
Independent project. Not affiliated with or endorsed by Bose Corporation.
Context: Cloud Shutdown
Bose is shutting down SoundTouch cloud services on May 6, 2026. After that, music service browsing, preset sync, and the official SoundTouch app stop working. This toolkit lets you keep your speakers fully functional.
See the Survival Guide for the full picture.
Tools
soundtouch-service — AfterTouch
A local server that replaces the Bose cloud ("AfterTouch"). Once your speaker is redirected to it, you have full control without any Bose cloud dependency. The built-in web UI at http://localhost:8000 handles all setup — no config files needed to get started.
If you want to run a server for this - no problem. The service is small enough to run on the SoundTouch itself. See the On-Device Installer for instructions.
Two scenarios:
Before shutdown — migrate your existing setup
While the Bose cloud is still running, use soundtouch-backup to save your account data. The local service web UI then helps with the migration so your speaker keeps its presets and credentials.
After shutdown or factory reset — start fresh Create a local account, configure your speakers, and start using them immediately. No Bose infrastructure required.
Redirecting your speaker
The service needs a stable address on your local network (e.g. soundtouch.fritz.box or soundtouch.local). The speaker must then be redirected to resolve the Bose cloud hostnames to that address. Two supported methods:
| Method | How it works | Notes |
|---|---|---|
| XML redirect | Upload a config XML via the Web API | Surgical; covers only registered endpoints; best for testing |
| DNS/DHCP | Serve custom DNS on your network | Covers all devices at once; requires port 53 and TLS |
The web UI walks you through each method. DNS redirect requires HTTPS — the service manages its own CA certificate and the web UI guides you through trusting it on each speaker.
Note: A hosts-file method (direct SSH edits to
/etc/hosts) also exists in the codebase but is deprecated and not exposed in the web UI.
Enabling SSH via USB stick
Some setup steps require SSH access to the speaker. Enable it once per device: create a file named remote_services on a FAT-formatted USB drive (the drive may need its bootable flag set — see SoundCork issue #172), and insert it while the speaker is powered on. After reboot, root SSH is available with no password.
See Device Initial Setup and Migration Guide for step-by-step instructions.
soundtouch-backup
Backs up your Bose cloud account (presets, paired devices, music sources) and each speaker's local state before the shutdown. Run soundtouch-backup all to capture everything in one step; it authenticates with the Bose cloud, then polls each paired speaker over the local network.
See the soundtouch-backup README for usage.
soundtouch-cli
Command-line control of any SoundTouch device: play/pause/volume, presets, source selection, multiroom zones, device discovery, and more. Works entirely over the local network — no cloud dependency. Well-suited for scripting and home automation.
See the CLI Reference for full usage.
soundtouch-web
A standalone web UI for device control — play, pause, volume, preset selection, real-time status — served from a local Go binary. Complements soundtouch-service when you want a dedicated device-control interface separate from the setup/admin UI.
See the soundtouch-web README for usage.
Go library
pkg/client provides a Go API for all SoundTouch device endpoints: media control, volume, presets, sources, zones, real-time WebSocket events, and device discovery. Use it to build your own integrations.
go get github.com/gesellix/bose-soundtouch
See the API Reference and pkg.go.dev for documentation.
Documentation
- Getting Started
- Survival Guide
- Migration Guide
- Device Initial Setup
- Migration & Safety Guide
- CLI Reference
- SoundTouch Service Guide
- HTTPS & CA Setup
- API Reference
Related projects
- SoundCork (Deborah Kaplan et al.) — Python service interception; pioneered the cloud emulation approach this project builds on
- SoundCork Stockholm App — Companion app for SoundCork
- SoundTouch Plus (Todd Lucas) — Home Assistant integration; extensive undocumented API documentation
- ÜberBöse API (Julius) — API research and advanced endpoint discovery
- Bose SoundTouch Hook (Adrian Böckenkamp) —
LD_PRELOADhooking for reverse engineering device internals
Support
- Bug reports: GitHub Issues
- Questions & discussions: GitHub Discussions
Star this project ⭐ if you find it useful!
License
MIT — see LICENSE.
SoundTouch is a trademark of Bose Corporation.