Dress CodeQL Findings (2)

Author: Lord-Grey

assets/webconfig/js/hyperion.js

@@ -124,8 +124,7 @@ function initWebSocket() {
           const success = response.success;
           const cmd = response.command;
           const tan = response.tan
-
-          if (success || typeof (success) === "undefined") {
+          if (success || typeof (success) == "undefined") {
             $(window.hyperion).trigger({ type: "cmd-" + cmd, response: response });
           }
           else
@@ -137,48 +136,41 @@ function initWebSocket() {
               } else {
                 const errorData = Array.isArray(response.errorData) ? response.errorData : [];
 
-                const safeError = sanitizeForLog(error);
-                const safeErrorData = errorData.map((item) => sanitizeForLog(item.description || ""));
-
-                console.log("[window.websocket::onmessage] ", safeError, ", Description:", safeErrorData);
+                // Sanitize provided input
+                const logError = error.replace(/\n|\r/g, "");
+                const logErrorData = JSON.stringify(errorData).replace(/[\r\n\t]/g, ' ')
+                console.log("[window.websocket::onmessage] ", logError, ", Description:", logErrorData);
 
                 $(window.hyperion).trigger({
                   type: "error",
                   reason: {
                     cmd: cmd,
-                    message: safeError,
-                    details: safeErrorData
+                    message: error,
+                    details: errorData.map((item) => item.description || "")
                   }
                 });
               }
             }
         }
         catch (exception_error) {
-          const safeExceptionMessage = sanitizeForLog(exception_error.message || 'Unknown error');
-          const safeExceptionStack = sanitizeForLog(exception_error.stack || '');
-
-          console.log("[window.websocket::onmessage] ", safeExceptionMessage);
-
+          console.log("[window.websocket::onmessage] ", exception_error);
           $(window.hyperion).trigger({
             type: "error",
             reason: {
-              message: $.i18n("ws_processing_exception") + ": " + safeExceptionMessage,
-              details: [safeExceptionStack]
+              message: $.i18n("ws_processing_exception") + ": " + exception_error.message,
+              details: [exception_error.stack]
             }
           });
         }
       };
 
       window.websocket.onerror = function (error) {
-        const safeError = sanitizeForLog(error?.message || String(error));
-
-        console.log("[window.websocket::onerror] ", safeError);
-
+        console.log("[window.websocket::onerror] ", error);
         $(window.hyperion).trigger({
           type: "error",
           reason: {
-           message: $.i18n("ws_error_occured"),
-            details: [safeError]
+            message: $.i18n("ws_error_occured"),
+            details: [error]
           }
         });
       };

assets/webconfig/js/wizards/LedDevice_philipshue.js

@@ -20,6 +20,11 @@ const philipshueWizard = (() => {
   let isAPIv2Ready = true;
   let isEntertainmentReady = true;
 
+  function isSafeKey(key) {
+    const unsafeKeys = ['__proto__', 'prototype', 'constructor'];
+    return typeof key === 'string' && !unsafeKeys.includes(key);
+  }
+
   function checkHueBridge(cb, hueUser) {
     const usr = (typeof hueUser != "undefined") ? hueUser : 'config';
     if (usr === 'config') {
@@ -349,6 +354,11 @@ const philipshueWizard = (() => {
     const ledType = 'philipshue';
     const key = hostAddress;
 
+    if (!isSafeKey(key) || !isSafeKey(username)) {
+      cb(false, username);
+      return;
+    }
+
     //Create ledType cache entry
     if (!devicesProperties[ledType]) {
       devicesProperties[ledType] = {};