Skip to content

bug: appendActivity uses raw DeviceID string slice which panics on short IDs #30

Description

@gitcoder89431

Problem

In internal/app/update.go, appendActivity truncates device IDs with a direct slice:

entry.Message = ev.DeviceID[:min(8, len(ev.DeviceID))] + " connected"

This is fine for valid Syncthing device IDs (always long), but if ev.DeviceID is ever empty (e.g. a malformed event, or an event type that didn't parse a device ID correctly), ev.DeviceID[:min(8, 0)] evaluates to ev.DeviceID[:0] which returns "" — harmless in that case. However the same pattern in handleGetActivity in mcpserver/server.go is:

out += fmt.Sprintf("● %s connected\n", ev.DeviceID[:min(8, len(ev.DeviceID))])

If DeviceID is empty and an event slips through, this silently emits a blank line. More importantly, both places should use shortID() which already handles this safely, keeping the logic in one place.

Fix

Export shortID (rename to ShortID) from the syncthing package and use it consistently in both update.go and server.go instead of inline slicing.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions