Tobias GesellchenandClaude Opus 4.8 188c5521b7 fix(datastore): sanitize wrapped errors in malformed-XML logs (CodeQL go/log-injection) ...

The #458 empty/0-byte resilience logging logged the raw xml.Unmarshal error with
%v. A parse error can echo attacker-controlled file content, so a newline-bearing
error string reached the log unsanitized (CodeQL go/log-injection, medium). Wrap
the error with sanitizeErr (strips \n/\r), the barrier logutil.go documents.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-04 19:38:12 +02:00

..

amazon

sec8: refactor zeroconf API to (host, port string) to close request-forgery alerts

2026-05-25 13:14:56 +02:00

bmx

fix(service): forward all TuneIn stream candidates for failover

2026-05-30 21:03:00 +02:00

certmanager

sec4: fix unhandled writable file close; ignore CODE-SCANNING-NOTES.md

2026-05-24 15:52:35 +02:00

constants

refactor(speaker): introduce pkg/speaker leaf for shared protocol constants

2026-05-11 23:18:08 +02:00

datastore

fix(datastore): sanitize wrapped errors in malformed-XML logs (CodeQL go/log-injection)

2026-06-04 19:38:12 +02:00

ding

fix(health): skip fetchHealth re-render for non-resolving quick fixes

2026-05-27 21:20:58 +02:00

export

feat(export): encrypted diagnostic report for issue reporting

2026-05-21 20:02:57 +02:00

handlers

feat(health): add speaker_clock check with set_clock quick-fix

2026-06-03 23:29:15 +02:00

health

feat(health): add speaker_clock check with set_clock quick-fix

2026-06-03 23:29:15 +02:00

logbuf

feat(service): add Logs tab streaming the live stderr trace

2026-05-19 20:12:25 +02:00

marge

fix(marge): never persist or serve sources without a resolvable provider id

2026-05-30 23:33:19 +02:00

proxy

sec8: move lgtm annotation above log.Printf to suppress CodeQL alert #294

2026-05-25 20:06:36 +02:00

setup

fix(setup): seed audionotification host(s) into /etc/hosts for /speaker TTS

2026-05-31 22:35:31 +02:00

soundtouchweb

feat(web): log playback requests and now_playing error transitions

2026-06-02 23:00:58 +02:00

spotify

sec8: refactor zeroconf API to (host, port string) to close request-forgery alerts

2026-05-25 13:14:56 +02:00

stations

feat(web): log playback requests and now_playing error transitions

2026-06-02 23:00:58 +02:00

stockholm

fix(lint): sec6/sec7 post-pass — static.go Close + remove unused sanitizeErr

2026-05-25 11:28:26 +02:00

testing/fakespeaker

fix(setup): fire <sourcesUpdated/> after data sync to recover post-factory-reset sources

2026-05-15 16:25:07 +02:00

tts

fix(tts): play via LOCAL_INTERNET_RADIO; accept app_key at /v1/auth

2026-05-31 22:35:31 +02:00

zeroconf

sec8: validate zeroconf port to break CodeQL taint chain (alerts 134/135/136)

2026-05-25 21:17:57 +02:00