homebridge-roborock-vacuum2 1.4.13 → 1.4.14

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 1.4.14
+- Hardened region detection by parsing the configured Roborock host instead of using substring matches.
+- Sanitized map obstacle image URLs before assigning them in the browser UI to reduce XSS and client-side redirect risk.
+- Added explicit read-only permissions to the CI workflow, upgraded GitHub Actions versions, and moved Codecov uploads to a repository secret.
+
 ## 1.4.13
 - Adjusted `package.json` repository metadata to match the fork URL exactly for npm Trusted Publishing compatibility.
 - Updated the npm publish workflow to use Node 24 and the latest npm CLI for Trusted Publishing compatibility.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "homebridge-roborock-vacuum2",
-  "version": "1.4.13",
+  "version": "1.4.14",
   "description": "Roborock Vacuum Cleaner - plugin for Homebridge.",
   "license": "MIT",
   "keywords": [

package/roborockLib/lib/map/zones.js

@@ -42,6 +42,44 @@ window.onload = function () {
 	var largePhoto = document.getElementById("largePhoto");
 	var largePhotoImage = document.getElementById("largePhoto-image");
 
+	function getSafeImageSource(rawValue) {
+		if (typeof rawValue !== "string") {
+			return null;
+		}
+
+		const value = rawValue.trim();
+		if (!value) {
+			return null;
+		}
+
+		if (/^data:image\//i.test(value) || value.startsWith("blob:")) {
+			return value;
+		}
+
+		try {
+			const imageURL = new URL(value, window.location.origin);
+			if (!["http:", "https:"].includes(imageURL.protocol)) {
+				return null;
+			}
+			if (imageURL.hostname !== window.location.hostname) {
+				return null;
+			}
+			return imageURL.toString();
+		} catch {
+			return null;
+		}
+	}
+
+	function applySafeImageSource(imageElement, rawValue) {
+		const safeImageSource = getSafeImageSource(rawValue);
+		if (!safeImageSource) {
+			console.warn("Ignoring unsafe obstacle image source");
+			return false;
+		}
+		imageElement.src = safeImageSource;
+		return true;
+	}
+
 	var socket = new WebSocket("ws://" + window.location.hostname + ":7906");
 
 	socket.onopen = () => {
@@ -292,8 +330,7 @@ window.onload = function () {
 					socket.onmessage = function (event) {
 						const serverData = JSON.parse(event.data);
 
-						if (serverData.image) {
-							popupImage.src = serverData.image;
+						if (serverData.image && applySafeImageSource(popupImage, serverData.image)) {
 							socket.onmessage = null;
 
 							popupImage.addEventListener("click", function () {
@@ -312,10 +349,9 @@ window.onload = function () {
 								socket.onmessage = function (event) {
 									const serverData = JSON.parse(event.data);
 
-									if (serverData.image) {
+									if (serverData.image && applySafeImageSource(largePhotoImage, serverData.image)) {
 										popup.style.display = "none";
 										largePhoto.style.display = "block";
-										largePhotoImage.src = serverData.image;
 
 										largePhotoImage.onclick = function () {
 											largePhoto.style.display = "none";

package/roborockLib/lib/roborockAuth.js

@@ -22,18 +22,27 @@ function normalizeBaseURL(baseURL) {
 	return baseURL.replace(/^https?:\/\//i, "").replace(/\/+$/, "");
 }
 
+function parseHostname(baseURL) {
+	try {
+		return new URL(`https://${normalizeBaseURL(baseURL)}`).hostname.toLowerCase();
+	} catch {
+		return normalizeBaseURL(baseURL).split("/")[0].split(":")[0].toLowerCase();
+	}
+}
+
 function getRegionConfig(baseURL) {
-	const lower = normalizeBaseURL(baseURL).toLowerCase();
-	if (lower.includes("euiot")) {
+	const hostname = parseHostname(baseURL);
+	const labels = hostname.split(".").filter(Boolean);
+	if (labels.includes("euiot")) {
 		return { country: "DE", countryCode: "49" };
 	}
-	if (lower.includes("usiot")) {
+	if (labels.includes("usiot")) {
 		return { country: "US", countryCode: "1" };
 	}
-	if (lower.includes("cniot")) {
+	if (labels.includes("cniot")) {
 		return { country: "CN", countryCode: "86" };
 	}
-	if (lower.includes("api.roborock.com")) {
+	if (hostname === "api.roborock.com") {
 		return { country: "SG", countryCode: "65" };
 	}
 	return { country: "US", countryCode: "1" };