add client mutation functions [sc-2035] #19
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| this.snapcastService.refreshState(); // Refresh the server state to get the latest data | ||
| }, | ||
| error: (err) => { | ||
| console.error(`ClientDetailsPage: Failed to refresh client ${this.id}`, err); |
Check failure
Code scanning / CodeQL
Use of externally-controlled format string High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 6 months ago
To address the issue, the id value should be sanitized or validated before being used in the log message. A simple and effective approach is to explicitly cast the id to a string and escape any potentially harmful characters. Alternatively, the %s format specifier can be used in the log message to ensure that the id is treated as a string.
The fix involves:
- Updating the log message on line 110 to use a
%sformat specifier and passing theidas a separate argument. - Ensuring that the
idis properly sanitized or validated before use.
| @@ -109,3 +109,3 @@ | ||
| error: (err) => { | ||
| console.error(`ClientDetailsPage: Failed to refresh client ${this.id}`, err); | ||
| console.error('ClientDetailsPage: Failed to refresh client %s', this.id, err); | ||
| } |
| return this.rpc('Client.GetStatus', { id }).pipe( | ||
| map(response => response.result as Client | undefined), | ||
| catchError(err => { | ||
| console.error(`SnapcastService: Failed to get status for client ${id}`, err); |
Check failure
Code scanning / CodeQL
Use of externally-controlled format string High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 6 months ago
To fix the issue, the untrusted id parameter should be passed as a separate argument to the format string using the %s specifier. This ensures that the id is treated as a string and prevents any unintended format specifiers from being interpreted. The fix involves modifying the console.error statement on line 375 of src/app/services/snapcast.service.ts.
| @@ -374,3 +374,3 @@ | ||
| catchError(err => { | ||
| console.error(`SnapcastService: Failed to get status for client ${id}`, err); | ||
| console.error('SnapcastService: Failed to get status for client %s', id, err); | ||
| return throwError(() => err); |
No description provided.