From ea53da9341fa1fcd96c57a4d7a09a11064a1d79e Mon Sep 17 00:00:00 2001 From: Sanaei Date: Sun, 19 Apr 2026 23:55:48 +0200 Subject: Add SSRF protection (#4044) * Add SSRF protection for custom geo downloads Introduce SSRF-safe HTTP transport for custom geo operations by adding ssrfSafeTransport and isBlockedIP helpers. The transport resolves hosts and blocks loopback, private, link-local and unspecified addresses, returning ErrCustomGeoSSRFBlocked on violations. Update probeCustomGeoURLWithGET, probeCustomGeoURL and downloadToPathOnce to use the safe transport. Also add the new error ErrCustomGeoSSRFBlocked and necessary imports. Minor whitespace/formatting adjustments in subClashService.go, web/entity/entity.go and web/service/setting.go. * Add path traversal protection for custom geo Prevent path traversal when handling custom geo downloads by adding ErrCustomGeoPathTraversal and a validateDestPath() helper that ensures destination paths stay inside the bin folder. Call validateDestPath from downloadToPathOnce, Update and Delete paths and wrap errors appropriately. Reconstruct sanitized URLs in sanitizeURL to break taint propagation before use. Map the new path-traversal error to a user-facing i18n message in the controller. * fix --- sub/subClashService.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'sub/subClashService.go') diff --git a/sub/subClashService.go b/sub/subClashService.go index ea095919..f0a8ca8a 100644 --- a/sub/subClashService.go +++ b/sub/subClashService.go @@ -160,10 +160,10 @@ func (s *SubClashService) getProxies(inbound *model.Inbound, client model.Client func (s *SubClashService) buildProxy(inbound *model.Inbound, client model.Client, stream map[string]any, extraRemark string) map[string]any { proxy := map[string]any{ - "name": s.SubService.genRemark(inbound, client.Email, extraRemark), + "name": s.SubService.genRemark(inbound, client.Email, extraRemark), "server": inbound.Listen, - "port": inbound.Port, - "udp": true, + "port": inbound.Port, + "udp": true, } network, _ := stream["network"].(string) -- cgit v1.2.3