Repository navigation
fix(voice): don't log the client-supplied sample rate - #1425
Merged
Merged
Conversation
CodeQL py/log-injection on the release PR: send_audio logged the sample_rate the voice WebSocket passes through unvalidated, so a crafted value could forge a log line. Log only the configured rate. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
CodeQL's
py/log-injectionflagged this on the 1.26.0 release PR (#1424). It came in with the Strands 1.57 bump (#1367).VoiceAgent.send_audiologssample_ratewhen it differs from the configured rate. That value comes straight off the voice WebSocket (msg.get("sample_rate", 16000)invoice_routes.py) without validation, so a client could send a string containing a newline and forge a log line.What changed
The debug line now logs only the configured rate (
Defaults.NOVA_SONIC_INPUT_RATE). The behaviour is unchanged: 1.57 fixes the sample rate in the model's audio config, and the client's value was only ever logged.Test plan
pytest tests -k voice: 122 passed, 4 skippeddevelopis merged into the release branch🤖 Generated with Claude Code