iobroker.goodwe-sems 0.1.5 → 0.1.6

package/README.md

@@ -144,6 +144,19 @@ Pull Requests willkommen, insbesondere um zusätzliche, vom Portal gelieferte Fe
 
 ### **WORK IN PROGRESS**
 
+### 0.1.6 (2026-07-18)
+
+Sicherheits-/Qualitätsaudit (Security-Tester, Maintainer-Review, Fuzzing der Mapping-Schicht):
+
+- (Stefan Bühler) **Security:** Wechselrichter-Seriennummern aus der (nicht vertrauenswürdigen) Portal-Antwort werden bereinigt, bevor sie Teil von ioBroker-Objekt-IDs werden (verhindert kaputte/unerwartet verschachtelte Objektbäume durch Sonderzeichen wie `.` `*` `]`)
+- (Stefan Bühler) **Security:** die vom Login-Server gelieferte API-Basis-URL wird validiert - nur HTTPS auf GoodWe-eigenen Domains (`*.semsportal.com`, `*.goodwe.com`), sonst Fallback auf die bekannte Regional-URL. Eine manipulierte Login-Antwort kann das Session-Token damit nicht mehr an fremde Hosts umleiten
+- (Stefan Bühler) **Fix:** `null`/defekte Einträge im `inverter[]`-Array des Portals ließen den kompletten Poll-Zyklus abstürzen - werden jetzt übersprungen, gesunde Wechselrichter derselben Antwort werden weiter verarbeitet
+- (Stefan Bühler) **Fix:** Zahlen in Exponentialschreibweise (`"1e5"`) wurden falsch geparst (ergab 15 statt 100000)
+- (Stefan Bühler) **Fix:** offensichtlich ungültige Portal-Zeitstempel (`99/99/9999 …`) erzeugten durch JS-Date-Rollover absurde Epochen-Werte - werden jetzt verworfen
+- (Stefan Bühler) **Fix:** automatische Anlagen-Erkennung filtert Einträge ohne verwertbare ID (verhinderte sonst dauerhafte Fehlzyklen)
+- (Stefan Bühler) **Robustheit:** keine State-Writes mehr nach Adapter-Unload; `adapterError`-Dedupe wird nach Erholung ebenfalls zurückgesetzt
+- (Stefan Bühler) 14 neue Regressionstests (42 Unit-Tests gesamt); `npm audit`: 0 Schwachstellen in Produktions-Dependencies (verbleibende betreffen ausschließlich Dev-Toolchain)
+
 ### 0.1.5 (2026-07-18)
 
 - (Stefan Bühler) fix: PayPal-Spendenlink im README korrigiert (Button-Link statt Donate-Link)

package/io-package.json

@@ -1,7 +1,7 @@
 {
   "common": {
     "name": "goodwe-sems",
-    "version": "0.1.5",
+    "version": "0.1.6",
     "news": {
       "0.1.2": {
         "en": "switch npm publishing from a long-lived token to OIDC trusted publishing (no stored secret)",
@@ -80,6 +80,19 @@
         "pl": "poprawka: poprawiono link do darowizny PayPal w README",
         "uk": "виправлення: виправлено посилання для пожертв PayPal у README",
         "zh-cn": "修复:更正 README 中的 PayPal 捐赠链接"
+      },
+      "0.1.6": {
+        "en": "security/quality audit: sanitize inverter serials used in state IDs, survive broken inverter array entries, validate server-provided API base URL (HTTPS + GoodWe domains only), fix scientific-notation number parsing, reject invalid portal timestamps, filter stations without id",
+        "de": "Sicherheits-/Qualitätsaudit: Wechselrichter-Seriennummern für State-IDs bereinigt, defekte Einträge im Inverter-Array abgefangen, vom Server gelieferte API-Basis-URL validiert (nur HTTPS + GoodWe-Domains), Zahlen-Parsing für Exponentialschreibweise korrigiert, ungültige Portal-Zeitstempel verworfen, Anlagen ohne ID gefiltert",
+        "ru": "аудит безопасности/качества: очистка серийных номеров инверторов в ID состояний, устойчивость к повреждённым записям, проверка базового URL API, исправлен разбор чисел, отклонение неверных меток времени",
+        "pt": "auditoria de segurança/qualidade: sanitização de números de série, tolerância a entradas corrompidas, validação da URL base da API, correção do parsing numérico, rejeição de timestamps inválidos",
+        "nl": "beveiligings-/kwaliteitsaudit: serienummers gesaneerd voor state-IDs, bestand tegen kapotte inverter-items, API-basis-URL gevalideerd, wetenschappelijke notatie gecorrigeerd, ongeldige tijdstempels afgewezen",
+        "fr": "audit sécurité/qualité : assainissement des numéros de série, tolérance aux entrées corrompues, validation de l URL de base de l API, correction de l analyse numérique, rejet des horodatages invalides",
+        "it": "audit di sicurezza/qualità: sanificazione dei numeri di serie, tolleranza a voci corrotte, validazione dell URL base API, correzione del parsing numerico, rifiuto di timestamp non validi",
+        "es": "auditoría de seguridad/calidad: saneamiento de números de serie, tolerancia a entradas corruptas, validación de la URL base de la API, corrección del análisis numérico, rechazo de marcas de tiempo inválidas",
+        "pl": "audyt bezpieczeństwa/jakości: sanityzacja numerów seryjnych, odporność na uszkodzone wpisy, walidacja bazowego URL API, poprawka parsowania liczb, odrzucanie nieprawidłowych znaczników czasu",
+        "uk": "аудит безпеки/якості: очищення серійних номерів, стійкість до пошкоджених записів, перевірка базової URL API, виправлення розбору чисел, відхилення недійсних міток часу",
+        "zh-cn": "安全/质量审计:清理用于状态ID的逆变器序列号、容忍损坏的数组条目、验证服务器提供的API基础URL、修复科学计数法解析、拒绝无效时间戳、过滤无ID电站"
       }
     },
     "title": "GoodWe SEMS Portal",

package/lib/mapping.js

@@ -21,6 +21,13 @@ function toNumber(value) {
         return Number.isFinite(value) ? value : undefined;
     }
     if (typeof value === "string") {
+        // Try the untouched string first so scientific notation ("1e5",
+        // "2.5E3") is parsed correctly instead of being mangled by the
+        // unit-stripping fallback below.
+        const direct = Number(value.trim());
+        if (value.trim() !== "" && Number.isFinite(direct)) {
+            return direct;
+        }
         const cleaned = value.replace(/[^0-9.+-]/g, "");
         if (cleaned === "" || cleaned === "-" || cleaned === "+") {
             return undefined;
@@ -66,9 +73,35 @@ function parsePortalTimestamp(value) {
         return Number.isNaN(fallback) ? undefined : fallback;
     }
     const [month, day, year, hour, minute, second] = match.slice(1).map(Number);
+    if (
+        month < 1 ||
+        month > 12 ||
+        day < 1 ||
+        day > 31 ||
+        hour > 23 ||
+        minute > 59 ||
+        second > 59
+    ) {
+        return undefined;
+    }
     return new Date(year, month - 1, day, hour, minute, second).getTime();
 }
 
+/**
+ * ioBroker object IDs must not contain the characters []*,;'"`<>\? or dots
+ * (dots create hierarchy levels) or whitespace. Inverter serials come from
+ * the (untrusted) portal response and are used as part of state IDs, so any
+ * forbidden character is replaced to prevent broken or unexpectedly nested
+ * object trees ("state-ID injection").
+ *
+ * @param {string} raw
+ * @returns {string}
+ */
+function sanitizeObjectId(raw) {
+    const cleaned = String(raw).replace(/[^0-9A-Za-z_-]/g, "_");
+    return cleaned || "_";
+}
+
 const NUM = (unit, role = "value") => ({
     type: "number",
     role,
@@ -276,9 +309,13 @@ function mapMonitorDetail(detail) {
         : [];
     const inverterSerials = [];
 
-    inverters.forEach((inv, index) => {
-        const sn =
+    inverters.forEach((rawInv, index) => {
+        // The portal has been observed to include null/garbage entries in the
+        // inverter array; one broken entry must never kill the whole cycle.
+        const inv = rawInv && typeof rawInv === "object" ? rawInv : {};
+        const rawSn =
             pick(inv, ["sn", "SN", "invertersn"]) || `UNKNOWN_${index + 1}`;
+        const sn = sanitizeObjectId(rawSn);
         inverterSerials.push(sn);
         const full = inv.invert_full || inv.d || {};
         const base = `Inverters.${sn}`;
@@ -405,4 +442,5 @@ module.exports = {
     pickNumber,
     parsePortalTimestamp,
     toNumber,
+    sanitizeObjectId,
 };

package/lib/semsApi.js

@@ -251,10 +251,49 @@ class SemsApi {
             uid: data.uid,
             token: data.token,
             timestamp: data.timestamp || Date.now(),
-            api: (json && json.api) || data.api || fallbackApi,
+            api: this._validateApiBase(
+                (json && json.api) || data.api,
+                fallbackApi,
+            ),
         };
     }
 
+    /**
+     * The login response dictates the base URL for all further (token-carrying)
+     * requests. Only accept HTTPS URLs on GoodWe-owned domains; anything else
+     * falls back to the known-good regional default. Prevents a manipulated
+     * login payload from redirecting the session token to a foreign host.
+     *
+     * @param {string|undefined} candidate
+     * @param {string} fallbackApi
+     * @returns {string}
+     */
+    _validateApiBase(candidate, fallbackApi) {
+        if (!candidate || typeof candidate !== "string") {
+            return fallbackApi;
+        }
+        try {
+            const url = new URL(candidate);
+            const host = url.hostname.toLowerCase();
+            const allowed =
+                url.protocol === "https:" &&
+                (host === "semsportal.com" ||
+                    host.endsWith(".semsportal.com") ||
+                    host === "goodwe.com" ||
+                    host.endsWith(".goodwe.com"));
+            if (allowed) {
+                return candidate;
+            }
+        } catch {
+            // fall through to fallback
+        }
+        this.log(
+            "warn",
+            `SEMS-Login lieferte eine unerwartete API-Basis-URL ("${candidate}") - verwende stattdessen ${fallbackApi}.`,
+        );
+        return fallbackApi;
+    }
+
     /**
      * Generic authenticated POST against the current session's API base,
      * with a single transparent re-login retry on auth failure.
@@ -325,14 +364,20 @@ class SemsApi {
     async getOwnedPowerStations() {
         const data = await this._authenticatedPost(STATION_LIST_PATH, {});
         if (Array.isArray(data)) {
-            return data.map((entry) => ({
-                id: entry.powerStationId || entry.id || entry.PowerStationId,
-                name:
-                    entry.stationName ||
-                    entry.name ||
-                    entry.powerStationName ||
-                    "",
-            }));
+            return data
+                .filter((entry) => entry && typeof entry === "object")
+                .map((entry) => ({
+                    id:
+                        entry.powerStationId ||
+                        entry.id ||
+                        entry.PowerStationId,
+                    name:
+                        entry.stationName ||
+                        entry.name ||
+                        entry.powerStationName ||
+                        "",
+                }))
+                .filter((entry) => entry.id);
         }
         if (data && typeof data === "object") {
             // Some regions return a single object instead of an array for accounts with one plant.

package/main.js

@@ -145,6 +145,9 @@ class GoodweSems extends utils.Adapter {
         try {
             await this._resolveStationId();
             const detail = await this.api.getMonitorDetail(this.stationId);
+            if (this.destroyed) {
+                return;
+            }
             await this._applyMonitorDetail(detail);
 
             this.consecutiveErrors = 0;
@@ -153,6 +156,7 @@ class GoodweSems extends utils.Adapter {
             this.notifier.resetDedupe("stationOffline");
             this.notifier.resetDedupe("loginFailure");
             this.notifier.resetDedupe("rateLimit");
+            this.notifier.resetDedupe("adapterError");
 
             await this.setStateAsync("info.connection", true, true);
             await this.setStateAsync(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "iobroker.goodwe-sems",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "ioBroker adapter to read GoodWe inverter data from the SEMS Portal cloud API (for installations without local/LAN access to the inverter).",
   "author": {
     "name": "bueste",