mirror of
https://github.com/gesellix/Bose-SoundTouch.git
synced 2026-08-19 00:56:16 +00:00
Tobias GesellchenandClaude Opus 4.7
fbeae8bb11
CodeQL alerts #70 and #71 (go/disabled-certificate-check) flagged the hard-coded `InsecureSkipVerify: true` in handlers_proxy.go (the /proxy/{url} reverse proxy) and mirror_middleware.go (the parity-check mirror). Both target *.bose.com whose certificate chain is becoming unreliable post end-of-service, but unconditionally disabling verification is still wrong: a deployment that doesn't actually need the bypass loses TLS hygiene for free. Add an `AllowInsecureUpstreamTLS bool` field to datastore.Settings, default false. Read it in both call sites — they aren't on a hot path — and pass the value as InsecureSkipVerify. CodeQL accepts the configurable boolean as a non-flag (vs. the previously hard-coded `true`), and the runtime behaviour now defaults to verifying certificates with an explicit opt-in for the broken-chain scenario. Behaviour change: TLS upstream traffic is verified by default. Anyone relying on the previous always-skip behaviour can re-enable it by setting `"allow_insecure_upstream_tls": true` in settings.json. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>