Security: Preset companionUrl stored without WebSocket protocol validation in backend schema

[LucasMaupin]

Summary

The companionUrl field in NewPreset and UpdatePreset schemas is declared as Type.Optional(Type.String()) with no format, pattern, or maxLength constraint. Any arbitrary value is accepted and persisted to the database.

Location

• src/models.ts — NewPreset and UpdatePreset type definitions
• src/api_groups.ts — POST /preset and PATCH /preset/:id handlers

Details

The frontend retrieves stored preset companionUrl values and auto-connects a WebSocket to them. A user who can create/update presets can therefore store an attacker-controlled WebSocket URL that silently redirects other users' Companion connections.

Note: Frontend issue #627 covers client-side companion URL validation, but the backend schema issue — storing the URL without server-side validation — is a separate and complementary gap.

An attacker-controlled URL could also be used to:

• Connect users to a malicious WebSocket server
• Exfiltrate audio device metadata sent over the companion connection

Recommendation

Add schema constraints to NewPreset and UpdatePreset:

companionUrl: Type.Optional(Type.String({ 
  maxLength: 500, 
  pattern: '^wss?://' 
}))

The backend should reject any companionUrl that does not start with ws:// or wss://.

Severity

MEDIUM