iobroker.goodwe-sems 0.1.5 → 0.1.7

package/README.md

@@ -144,6 +144,25 @@ Pull Requests willkommen, insbesondere um zusätzliche, vom Portal gelieferte Fe
 
 ### **WORK IN PROGRESS**
 
+### 0.1.7 (2026-07-19)
+
+- (Stefan Bühler) Branding: Platzhalter-Icon durch das offizielle GoodWe-Logo ersetzt (mit Genehmigung von GoodWe verwendet)
+
+### 0.1.6 (2026-07-18)
+
+- (Stefan Bühler) Dev-Toolchain aktualisiert: mocha 11, sinon 22, @alcalzone/release-script 5, @iobroker/eslint-config 2; verbleibende transitive CVEs (adm-zip, diff, esbuild, serialize-javascript) per npm-`overrides` erzwungen behoben - `npm audit`: 0 Schwachstellen (auch inkl. Dev-Dependencies)
+
+Sicherheits-/Qualitätsaudit (Security-Tester, Maintainer-Review, Fuzzing der Mapping-Schicht):
+
+- (Stefan Bühler) **Security:** Wechselrichter-Seriennummern aus der (nicht vertrauenswürdigen) Portal-Antwort werden bereinigt, bevor sie Teil von ioBroker-Objekt-IDs werden (verhindert kaputte/unerwartet verschachtelte Objektbäume durch Sonderzeichen wie `.` `*` `]`)
+- (Stefan Bühler) **Security:** die vom Login-Server gelieferte API-Basis-URL wird validiert - nur HTTPS auf GoodWe-eigenen Domains (`*.semsportal.com`, `*.goodwe.com`), sonst Fallback auf die bekannte Regional-URL. Eine manipulierte Login-Antwort kann das Session-Token damit nicht mehr an fremde Hosts umleiten
+- (Stefan Bühler) **Fix:** `null`/defekte Einträge im `inverter[]`-Array des Portals ließen den kompletten Poll-Zyklus abstürzen - werden jetzt übersprungen, gesunde Wechselrichter derselben Antwort werden weiter verarbeitet
+- (Stefan Bühler) **Fix:** Zahlen in Exponentialschreibweise (`"1e5"`) wurden falsch geparst (ergab 15 statt 100000)
+- (Stefan Bühler) **Fix:** offensichtlich ungültige Portal-Zeitstempel (`99/99/9999 …`) erzeugten durch JS-Date-Rollover absurde Epochen-Werte - werden jetzt verworfen
+- (Stefan Bühler) **Fix:** automatische Anlagen-Erkennung filtert Einträge ohne verwertbare ID (verhinderte sonst dauerhafte Fehlzyklen)
+- (Stefan Bühler) **Robustheit:** keine State-Writes mehr nach Adapter-Unload; `adapterError`-Dedupe wird nach Erholung ebenfalls zurückgesetzt
+- (Stefan Bühler) 14 neue Regressionstests (42 Unit-Tests gesamt); `npm audit`: 0 Schwachstellen in Produktions-Dependencies (verbleibende betreffen ausschließlich Dev-Toolchain)
+
 ### 0.1.5 (2026-07-18)
 
 - (Stefan Bühler) fix: PayPal-Spendenlink im README korrigiert (Button-Link statt Donate-Link)

package/io-package.json

@@ -1,7 +1,7 @@
 {
   "common": {
     "name": "goodwe-sems",
-    "version": "0.1.5",
+    "version": "0.1.7",
     "news": {
       "0.1.2": {
         "en": "switch npm publishing from a long-lived token to OIDC trusted publishing (no stored secret)",
@@ -80,6 +80,32 @@
         "pl": "poprawka: poprawiono link do darowizny PayPal w README",
         "uk": "виправлення: виправлено посилання для пожертв PayPal у README",
         "zh-cn": "修复:更正 README 中的 PayPal 捐赠链接"
+      },
+      "0.1.6": {
+        "en": "security/quality audit: sanitize inverter serials used in state IDs, survive broken inverter array entries, validate server-provided API base URL (HTTPS + GoodWe domains only), fix scientific-notation number parsing, reject invalid portal timestamps, filter stations without id",
+        "de": "Sicherheits-/Qualitätsaudit: Wechselrichter-Seriennummern für State-IDs bereinigt, defekte Einträge im Inverter-Array abgefangen, vom Server gelieferte API-Basis-URL validiert (nur HTTPS + GoodWe-Domains), Zahlen-Parsing für Exponentialschreibweise korrigiert, ungültige Portal-Zeitstempel verworfen, Anlagen ohne ID gefiltert",
+        "ru": "аудит безопасности/качества: очистка серийных номеров инверторов в ID состояний, устойчивость к повреждённым записям, проверка базового URL API, исправлен разбор чисел, отклонение неверных меток времени",
+        "pt": "auditoria de segurança/qualidade: sanitização de números de série, tolerância a entradas corrompidas, validação da URL base da API, correção do parsing numérico, rejeição de timestamps inválidos",
+        "nl": "beveiligings-/kwaliteitsaudit: serienummers gesaneerd voor state-IDs, bestand tegen kapotte inverter-items, API-basis-URL gevalideerd, wetenschappelijke notatie gecorrigeerd, ongeldige tijdstempels afgewezen",
+        "fr": "audit sécurité/qualité : assainissement des numéros de série, tolérance aux entrées corrompues, validation de l URL de base de l API, correction de l analyse numérique, rejet des horodatages invalides",
+        "it": "audit di sicurezza/qualità: sanificazione dei numeri di serie, tolleranza a voci corrotte, validazione dell URL base API, correzione del parsing numerico, rifiuto di timestamp non validi",
+        "es": "auditoría de seguridad/calidad: saneamiento de números de serie, tolerancia a entradas corruptas, validación de la URL base de la API, corrección del análisis numérico, rechazo de marcas de tiempo inválidas",
+        "pl": "audyt bezpieczeństwa/jakości: sanityzacja numerów seryjnych, odporność na uszkodzone wpisy, walidacja bazowego URL API, poprawka parsowania liczb, odrzucanie nieprawidłowych znaczników czasu",
+        "uk": "аудит безпеки/якості: очищення серійних номерів, стійкість до пошкоджених записів, перевірка базової URL API, виправлення розбору чисел, відхилення недійсних міток часу",
+        "zh-cn": "安全/质量审计:清理用于状态ID的逆变器序列号、容忍损坏的数组条目、验证服务器提供的API基础URL、修复科学计数法解析、拒绝无效时间戳、过滤无ID电站"
+      },
+      "0.1.7": {
+        "en": "branding: replace placeholder icon with the official GoodWe logo (used with permission from GoodWe)",
+        "de": "Branding: Platzhalter-Icon durch das offizielle GoodWe-Logo ersetzt (mit Genehmigung von GoodWe verwendet)",
+        "ru": "брендинг: заменена иконка-заполнитель на официальный логотип GoodWe (используется с разрешения GoodWe)",
+        "pt": "marca: ícone substituído pelo logótipo oficial da GoodWe (usado com autorização da GoodWe)",
+        "nl": "branding: placeholder-icoon vervangen door het officiële GoodWe-logo (gebruikt met toestemming van GoodWe)",
+        "fr": "image de marque : icône remplacée par le logo officiel GoodWe (utilisé avec l autorisation de GoodWe)",
+        "it": "branding: icona sostituita con il logo ufficiale GoodWe (utilizzato con l autorizzazione di GoodWe)",
+        "es": "marca: icono sustituido por el logotipo oficial de GoodWe (utilizado con permiso de GoodWe)",
+        "pl": "branding: zastąpiono ikonę zastępczą oficjalnym logo GoodWe (używane za zgodą GoodWe)",
+        "uk": "брендинг: замінено іконку-заповнювач на офіційний логотип GoodWe (використовується з дозволу GoodWe)",
+        "zh-cn": "品牌:将占位图标替换为 GoodWe 官方标志(经 GoodWe 许可使用)"
       }
     },
     "title": "GoodWe SEMS Portal",

package/lib/mapping.js

@@ -21,6 +21,13 @@ function toNumber(value) {
         return Number.isFinite(value) ? value : undefined;
     }
     if (typeof value === "string") {
+        // Try the untouched string first so scientific notation ("1e5",
+        // "2.5E3") is parsed correctly instead of being mangled by the
+        // unit-stripping fallback below.
+        const direct = Number(value.trim());
+        if (value.trim() !== "" && Number.isFinite(direct)) {
+            return direct;
+        }
         const cleaned = value.replace(/[^0-9.+-]/g, "");
         if (cleaned === "" || cleaned === "-" || cleaned === "+") {
             return undefined;
@@ -66,9 +73,35 @@ function parsePortalTimestamp(value) {
         return Number.isNaN(fallback) ? undefined : fallback;
     }
     const [month, day, year, hour, minute, second] = match.slice(1).map(Number);
+    if (
+        month < 1 ||
+        month > 12 ||
+        day < 1 ||
+        day > 31 ||
+        hour > 23 ||
+        minute > 59 ||
+        second > 59
+    ) {
+        return undefined;
+    }
     return new Date(year, month - 1, day, hour, minute, second).getTime();
 }
 
+/**
+ * ioBroker object IDs must not contain the characters []*,;'"`<>\? or dots
+ * (dots create hierarchy levels) or whitespace. Inverter serials come from
+ * the (untrusted) portal response and are used as part of state IDs, so any
+ * forbidden character is replaced to prevent broken or unexpectedly nested
+ * object trees ("state-ID injection").
+ *
+ * @param {string} raw
+ * @returns {string}
+ */
+function sanitizeObjectId(raw) {
+    const cleaned = String(raw).replace(/[^0-9A-Za-z_-]/g, "_");
+    return cleaned || "_";
+}
+
 const NUM = (unit, role = "value") => ({
     type: "number",
     role,
@@ -90,8 +123,8 @@ const BOOL = (role = "indicator") => ({
 });
 
 /**
- * @param {any} detail raw "data" object from GetMonitorDetailByPowerstationId
- * @returns {{points: Array<{id:string, name:string, common:object, value:any}>, inverterSerials: string[]}}
+ * @param {object} detail raw "data" object from GetMonitorDetailByPowerstationId
+ * @returns {{points: Array<{id:string, name:string, common:object, value:unknown}>, inverterSerials: string[]}}
  */
 function mapMonitorDetail(detail) {
     const points = [];
@@ -276,9 +309,13 @@ function mapMonitorDetail(detail) {
         : [];
     const inverterSerials = [];
 
-    inverters.forEach((inv, index) => {
-        const sn =
+    inverters.forEach((rawInv, index) => {
+        // The portal has been observed to include null/garbage entries in the
+        // inverter array; one broken entry must never kill the whole cycle.
+        const inv = rawInv && typeof rawInv === "object" ? rawInv : {};
+        const rawSn =
             pick(inv, ["sn", "SN", "invertersn"]) || `UNKNOWN_${index + 1}`;
+        const sn = sanitizeObjectId(rawSn);
         inverterSerials.push(sn);
         const full = inv.invert_full || inv.d || {};
         const base = `Inverters.${sn}`;
@@ -405,4 +442,5 @@ module.exports = {
     pickNumber,
     parsePortalTimestamp,
     toNumber,
+    sanitizeObjectId,
 };

package/lib/semsApi.js

@@ -72,7 +72,7 @@ const DEFAULT_CLIENT_TOKEN = JSON.stringify({
  *
  * @param {string} url
  * @param {object} init fetch init, `timeoutMs` is consumed here and not passed on
- * @returns {Promise<{status:number, json: any, text: string}>}
+ * @returns {Promise<{status:number, json: object, text: string}>}
  */
 async function httpPostJson(url, init) {
     const { timeoutMs, ...fetchInit } = init;
@@ -251,10 +251,49 @@ class SemsApi {
             uid: data.uid,
             token: data.token,
             timestamp: data.timestamp || Date.now(),
-            api: (json && json.api) || data.api || fallbackApi,
+            api: this._validateApiBase(
+                (json && json.api) || data.api,
+                fallbackApi,
+            ),
         };
     }
 
+    /**
+     * The login response dictates the base URL for all further (token-carrying)
+     * requests. Only accept HTTPS URLs on GoodWe-owned domains; anything else
+     * falls back to the known-good regional default. Prevents a manipulated
+     * login payload from redirecting the session token to a foreign host.
+     *
+     * @param {string|undefined} candidate
+     * @param {string} fallbackApi
+     * @returns {string}
+     */
+    _validateApiBase(candidate, fallbackApi) {
+        if (!candidate || typeof candidate !== "string") {
+            return fallbackApi;
+        }
+        try {
+            const url = new URL(candidate);
+            const host = url.hostname.toLowerCase();
+            const allowed =
+                url.protocol === "https:" &&
+                (host === "semsportal.com" ||
+                    host.endsWith(".semsportal.com") ||
+                    host === "goodwe.com" ||
+                    host.endsWith(".goodwe.com"));
+            if (allowed) {
+                return candidate;
+            }
+        } catch {
+            // fall through to fallback
+        }
+        this.log(
+            "warn",
+            `SEMS-Login lieferte eine unerwartete API-Basis-URL ("${candidate}") - verwende stattdessen ${fallbackApi}.`,
+        );
+        return fallbackApi;
+    }
+
     /**
      * Generic authenticated POST against the current session's API base,
      * with a single transparent re-login retry on auth failure.
@@ -325,14 +364,20 @@ class SemsApi {
     async getOwnedPowerStations() {
         const data = await this._authenticatedPost(STATION_LIST_PATH, {});
         if (Array.isArray(data)) {
-            return data.map((entry) => ({
-                id: entry.powerStationId || entry.id || entry.PowerStationId,
-                name:
-                    entry.stationName ||
-                    entry.name ||
-                    entry.powerStationName ||
-                    "",
-            }));
+            return data
+                .filter((entry) => entry && typeof entry === "object")
+                .map((entry) => ({
+                    id:
+                        entry.powerStationId ||
+                        entry.id ||
+                        entry.PowerStationId,
+                    name:
+                        entry.stationName ||
+                        entry.name ||
+                        entry.powerStationName ||
+                        "",
+                }))
+                .filter((entry) => entry.id);
         }
         if (data && typeof data === "object") {
             // Some regions return a single object instead of an array for accounts with one plant.

package/main.js

@@ -145,6 +145,9 @@ class GoodweSems extends utils.Adapter {
         try {
             await this._resolveStationId();
             const detail = await this.api.getMonitorDetail(this.stationId);
+            if (this.destroyed) {
+                return;
+            }
             await this._applyMonitorDetail(detail);
 
             this.consecutiveErrors = 0;
@@ -153,6 +156,7 @@ class GoodweSems extends utils.Adapter {
             this.notifier.resetDedupe("stationOffline");
             this.notifier.resetDedupe("loginFailure");
             this.notifier.resetDedupe("rateLimit");
+            this.notifier.resetDedupe("adapterError");
 
             await this.setStateAsync("info.connection", true, true);
             await this.setStateAsync(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "iobroker.goodwe-sems",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "ioBroker adapter to read GoodWe inverter data from the SEMS Portal cloud API (for installations without local/LAN access to the inverter).",
   "author": {
     "name": "bueste",
@@ -54,16 +54,22 @@
     "@iobroker/adapter-core": "^3.1.6"
   },
   "devDependencies": {
-    "@alcalzone/release-script": "^3.8.0",
-    "@alcalzone/release-script-plugin-iobroker": "^3.7.2",
-    "@alcalzone/release-script-plugin-license": "^3.7.0",
+    "@alcalzone/release-script": "^5.2.1",
+    "@alcalzone/release-script-plugin-iobroker": "^5.2.0",
+    "@alcalzone/release-script-plugin-license": "^5.2.0",
     "@iobroker/adapter-dev": "^1.3.0",
-    "@iobroker/eslint-config": "^1.0.0",
+    "@iobroker/eslint-config": "^2.3.4",
     "@iobroker/testing": "^5.0.0",
     "chai": "^4.4.1",
     "chai-as-promised": "^7.1.2",
     "eslint": "^9.9.0",
-    "mocha": "^10.7.0",
-    "sinon": "^18.0.0"
+    "mocha": "^11.7.6",
+    "sinon": "^22.0.0"
+  },
+  "overrides": {
+    "adm-zip": "^0.6.0",
+    "diff": "^8.0.3",
+    "esbuild": "^0.25.0",
+    "serialize-javascript": "^7.0.5"
   }
 }