fix(sub): treat external subscription providers as untrusted input

A client's external subscription is fetched from a third party on every
subscriber refresh, and the fetcher trusted it more than its siblings:
- it dialled any address, redirects included; it now goes through the
  SSRF guard like the outbound subscription and remote routing fetchers;
- it forwarded any line containing "://"; it now keeps only server share
  links, so app deeplinks and plain URLs never reach the subscriber's app;
- it bounded the body but not the link count (now 1000) or the headers
  (now 64 KiB), and stored the raw error, URL included, on every row; the
  stored error is now host-only and at most 1 KiB.

The link parser also refuses links that nest JSON past 16 levels, since
the JSON subscription pretty-prints it at quadratic cost, and external
configs are marshalled compactly until the final, single indent pass.

internal/sub/external_config.go

@@ -203,7 +203,8 @@ func parsedExternalOutbound(rawLink string) json_util.RawMessage {
 		return nil
 	}
 	ob["tag"] = "proxy"
-	b, err := json.MarshalIndent(ob, "", "  ")
+	// Compact: the response is indented once at the end, and each extra pass costs per level.
+	b, err := json.Marshal(ob)
 	if err != nil {
 		return nil
 	}

internal/sub/external_config_test.go

@@ -3,6 +3,7 @@ package sub
 import (
 	"encoding/base64"
 	"net/url"
+	"slices"
 	"strings"
 	"testing"
 	"time"
@@ -176,3 +177,15 @@ func TestClashProxyFromExternalTrojanReality(t *testing.T) {
 		t.Fatalf("expected reality→tls true, got %v", proxy["tls"])
 	}
 }
+
+// Only server links pass: an app deeplink or a plain URL from the provider would reach the
+// subscriber's app as a directive (a routing profile, an import) the operator never chose.
+func TestDecodeSubscriptionBodyKeepsOnlyServerShareLinks(t *testing.T) {
+	body := []byte("VLESS://u@a:1#a\nincy://autorouting/onadd/https://p.example/r.json\nhttps://p.example/page\n" +
+		"happ://routing/add/x\nvpn://payload\ntuic://u:p@a:1#t\nhy2://p@a:1#h\nnot a link://x\n")
+	got := decodeSubscriptionBody(body)
+	want := []string{"VLESS://u@a:1#a", "vpn://payload", "tuic://u:p@a:1#t", "hy2://p@a:1#h"}
+	if !slices.Equal(got, want) {
+		t.Fatalf("decoded links = %q, want %q", got, want)
+	}
+}

internal/sub/external_hwid_test.go

@@ -13,6 +13,7 @@ import (
 // #6559: the Master panel must send a stable X-HWID when fetching external
 // subscriptions, otherwise an HWID-limited donor answers 404.
 func TestFetchSendsStableHwid(t *testing.T) {
+	allowLoopbackProvider(t)
 	dbtest.InitDB(t, filepath.Join(t.TempDir(), "x-ui.db"))
 
 	var gotHwid string

internal/sub/external_subscription.go

@@ -5,6 +5,7 @@ import (
 	"encoding/base64"
 	"io"
 	"net/http"
+	"slices"
 	"strings"
 	"sync"
 	"time"
@@ -12,6 +13,8 @@ import (
 	"github.com/mhsanaei/3x-ui/v3/internal/database"
 	"github.com/mhsanaei/3x-ui/v3/internal/database/model"
 	"github.com/mhsanaei/3x-ui/v3/internal/logger"
+	"github.com/mhsanaei/3x-ui/v3/internal/util/common"
+	"github.com/mhsanaei/3x-ui/v3/internal/util/netsafe"
 	"github.com/mhsanaei/3x-ui/v3/internal/web/service"
 )
 
@@ -21,10 +24,21 @@ import (
 const (
 	subscriptionCacheTTL      = 5 * time.Minute
 	subscriptionMaxBytes      = 2 << 20 // 2 MiB
+	subscriptionMaxLinks      = 1000
 	subscriptionCacheCapacity = 256
 )
 
-var subscriptionHTTPClient = &http.Client{Timeout: 6 * time.Second}
+// The provider picks every redirect target, so each hop is resolved, checked and dialed by
+// the SSRF guard; its headers are bounded like its body.
+var subscriptionHTTPClient = &http.Client{
+	Timeout: 6 * time.Second,
+	Transport: &http.Transport{
+		DialContext:            netsafe.SSRFGuardedDialContext,
+		TLSHandshakeTimeout:    5 * time.Second,
+		MaxResponseHeaderBytes: 64 << 10,
+		IdleConnTimeout:        90 * time.Second,
+	},
+}
 
 type subscriptionCacheEntry struct {
 	links     []string
@@ -129,7 +143,7 @@ func recordExternalSubscriptionFetch(rawURL string, fetchErr error) {
 	}
 	lastFetchError := ""
 	if fetchErr != nil {
-		lastFetchError = fetchErr.Error()
+		lastFetchError = common.TruncateStatusText(service.WithoutRequestURL(fetchErr).Error())
 	}
 	if err := database.GetDB().
 		Model(&model.ClientExternalLink{}).
@@ -138,14 +152,14 @@ func recordExternalSubscriptionFetch(rawURL string, fetchErr error) {
 			"last_fetch_at":    time.Now().UnixMilli(),
 			"last_fetch_error": lastFetchError,
 		}).Error; err != nil {
-		logger.Warningf("sub: recording fetch status for external subscription %q: %v", rawURL, err)
+		logger.Warningf("sub: recording fetch status for an external subscription: %v", err)
 	}
 }
 
 func doFetchSubscriptionLinks(rawURL string) ([]string, error) {
 	req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, rawURL, nil)
 	if err != nil {
-		return nil, err
+		return nil, service.WithoutRequestURL(err)
 	}
 	// Some providers gate the link body on a known client User-Agent.
 	req.Header.Set("User-Agent", externalSubUserAgent())
@@ -155,7 +169,7 @@ func doFetchSubscriptionLinks(rawURL string) ([]string, error) {
 	}
 	resp, err := subscriptionHTTPClient.Do(req)
 	if err != nil {
-		return nil, err
+		return nil, service.WithoutRequestURL(err)
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
@@ -168,12 +182,17 @@ func doFetchSubscriptionLinks(rawURL string) ([]string, error) {
 	if len(body) > subscriptionMaxBytes {
 		return nil, errSubscriptionBodyTooLarge
 	}
-	return decodeSubscriptionBody(body), nil
+	links := decodeSubscriptionBody(body)
+	if len(links) > subscriptionMaxLinks {
+		return nil, errSubscriptionTooManyLinks
+	}
+	return links, nil
 }
 
 var (
 	errBadStatus                = &subError{"non-2xx subscription response"}
 	errSubscriptionBodyTooLarge = &subError{"subscription response body exceeds size limit"}
+	errSubscriptionTooManyLinks = &subError{"subscription lists more than 1000 share links"}
 )
 
 // externalSubUserAgent returns the panel setting for external subscription
@@ -193,8 +212,16 @@ type subError struct{ msg string }
 
 func (e *subError) Error() string { return e.msg }
 
-// decodeSubscriptionBody handles the common base64-encoded newline list as well
-// as a plain-text body, returning only the lines that look like share links.
+// serverShareLinkSchemes are the server links a raw subscription carries on: what the link
+// parser reads, what the panel itself writes, and common third-party server schemes.
+var serverShareLinkSchemes = []string{
+	"vmess", "vless", "trojan", "ss", "ssr", "hysteria", "hysteria2", "hy2", "tuic", "wireguard", "wg",
+	"vpn", "socks", "socks5", "anytls", "juicity", "naive+https", "tg",
+}
+
+// decodeSubscriptionBody handles the common base64-encoded newline list as well as a
+// plain-text body, keeping only server share links: app deeplinks and plain URLs would
+// reach the subscriber's app as directives the operator never chose.
 func decodeSubscriptionBody(body []byte) []string {
 	text := strings.TrimSpace(string(body))
 	if text == "" {
@@ -210,7 +237,8 @@ func decodeSubscriptionBody(body []byte) []string {
 		if ln == "" || strings.HasPrefix(ln, "#") {
 			continue
 		}
-		if strings.Contains(ln, "://") {
+		scheme, _, found := strings.Cut(ln, "://")
+		if found && slices.ContainsFunc(serverShareLinkSchemes, func(s string) bool { return strings.EqualFold(s, scheme) }) {
 			out = append(out, ln)
 		}
 	}

internal/sub/external_subscription_test.go

@@ -2,6 +2,7 @@ package sub
 
 import (
 	"errors"
+	"net"
 	"net/http"
 	"net/http/httptest"
 	"path/filepath"
@@ -17,6 +18,17 @@ import (
 	"github.com/mhsanaei/3x-ui/v3/internal/database/model"
 )
 
+// allowLoopbackProvider lets a test serve its provider from httptest on 127.0.0.1, which
+// the guarded production dialer refuses; every other transport limit stays.
+func allowLoopbackProvider(t *testing.T) {
+	t.Helper()
+	previous := subscriptionHTTPClient
+	transport := previous.Transport.(*http.Transport).Clone()
+	transport.DialContext = (&net.Dialer{}).DialContext
+	subscriptionHTTPClient = &http.Client{Timeout: previous.Timeout, Transport: transport}
+	t.Cleanup(func() { subscriptionHTTPClient = previous })
+}
+
 func resetSubscriptionCache(t *testing.T) {
 	t.Helper()
 	subscriptionCache.Lock()
@@ -34,6 +46,7 @@ func resetSubscriptionCache(t *testing.T) {
 }
 
 func TestFetchSubscriptionLinksSharesConcurrentRefresh(t *testing.T) {
+	allowLoopbackProvider(t)
 	resetSubscriptionCache(t)
 	var requests atomic.Int32
 	release := make(chan struct{})
@@ -69,6 +82,7 @@ func TestFetchSubscriptionLinksSharesConcurrentRefresh(t *testing.T) {
 }
 
 func TestFetchSubscriptionLinksBoundsCacheSize(t *testing.T) {
+	allowLoopbackProvider(t)
 	resetSubscriptionCache(t)
 	var requests atomic.Int32
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -96,6 +110,7 @@ func TestFetchSubscriptionLinksBoundsCacheSize(t *testing.T) {
 }
 
 func TestFetchSubscriptionLinksSharesStaleResultAfterRefreshFailure(t *testing.T) {
+	allowLoopbackProvider(t)
 	resetSubscriptionCache(t)
 	stale := []string{"vless://stale@example.com:443"}
 	release := make(chan struct{})
@@ -150,6 +165,7 @@ func TestFetchSubscriptionLinksSharesStaleResultAfterRefreshFailure(t *testing.T
 }
 
 func TestDoFetchSubscriptionLinks_RejectsOversizedBody(t *testing.T) {
+	allowLoopbackProvider(t)
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		_, _ = w.Write([]byte(strings.Repeat("a", subscriptionMaxBytes+1)))
 	}))
@@ -165,6 +181,7 @@ func TestDoFetchSubscriptionLinks_RejectsOversizedBody(t *testing.T) {
 }
 
 func TestDoFetchSubscriptionLinks_AcceptsBodyAtLimit(t *testing.T) {
+	allowLoopbackProvider(t)
 	link := "vless://example"
 	body := link + "\n" + strings.Repeat("#", subscriptionMaxBytes-len(link)-1)
 	if len(body) != subscriptionMaxBytes {
@@ -185,6 +202,7 @@ func TestDoFetchSubscriptionLinks_AcceptsBodyAtLimit(t *testing.T) {
 }
 
 func TestRecordExternalSubscriptionFetchStampsEveryRowForTheURL(t *testing.T) {
+	allowLoopbackProvider(t)
 	initMutDB(t)
 	resetSubscriptionCache(t)
 	db := database.GetDB()
@@ -302,6 +320,7 @@ func TestExpandEntryCacheHitWritesNothing(t *testing.T) {
 }
 
 func TestFetchUsesConfiguredExternalSubUserAgent(t *testing.T) {
+	allowLoopbackProvider(t)
 	resetSubscriptionCache(t)
 	dbtest.InitDB(t, filepath.Join(t.TempDir(), "ua.db"))
 
@@ -330,6 +349,7 @@ func TestFetchUsesConfiguredExternalSubUserAgent(t *testing.T) {
 }
 
 func TestFetchFallsBackToDefaultExternalSubUserAgent(t *testing.T) {
+	allowLoopbackProvider(t)
 	resetSubscriptionCache(t)
 	dbtest.InitDB(t, filepath.Join(t.TempDir(), "ua-default.db"))
 
@@ -348,3 +368,61 @@ func TestFetchFallsBackToDefaultExternalSubUserAgent(t *testing.T) {
 		t.Fatalf("User-Agent = %q, want default v2rayNG/1.8.5", gotUA)
 	}
 }
+
+// The provider chooses where the fetch goes, every redirect included, so the dial itself
+// must refuse this host and its network.
+func TestDoFetchSubscriptionLinksRefusesPrivateTargets(t *testing.T) {
+	var hits atomic.Int32
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		hits.Add(1)
+		_, _ = w.Write([]byte("vless://uuid@example.com:443#internal"))
+	}))
+	defer srv.Close()
+	if links, err := doFetchSubscriptionLinks(srv.URL + "/admin"); err == nil || links != nil {
+		t.Fatalf("fetch of a loopback target = %v, %v; want it refused", links, err)
+	}
+	if hits.Load() != 0 {
+		t.Fatalf("the loopback target received %d request(s)", hits.Load())
+	}
+}
+
+// Fetch errors are stored on every row holding the URL and shown in the panel: they may
+// name the host, never the URL (a credential), and a provider must not size them.
+func TestExternalSubscriptionFetchErrorIsBoundedAndKeepsTheURLSecret(t *testing.T) {
+	initMutDB(t)
+	resetSubscriptionCache(t)
+	allowLoopbackProvider(t)
+	const token = "s3cr3t-token"
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("X-Junk", strings.Repeat("j", 128<<10))
+		_, _ = w.Write([]byte("vless://uuid@example.com:443#Node"))
+	}))
+	defer srv.Close()
+	rawURL := srv.URL + "/sub/" + token
+	if err := database.GetDB().Create(&model.ClientExternalLink{Kind: model.ExternalLinkKindSubscription, Value: rawURL}).Error; err != nil {
+		t.Fatalf("seed link: %v", err)
+	}
+	result := fetchSubscriptionLinks(rawURL)
+	if result.err == nil {
+		t.Fatal("a provider with 128 KiB of headers was accepted")
+	}
+	recordExternalSubscriptionFetch(rawURL, result.err)
+	var row model.ClientExternalLink
+	if err := database.GetDB().Where("value = ?", rawURL).First(&row).Error; err != nil {
+		t.Fatalf("load link: %v", err)
+	}
+	if row.LastFetchError == "" || strings.Contains(row.LastFetchError, token) || len(row.LastFetchError) > 1100 {
+		t.Fatalf("last_fetch_error = %.200q (%d bytes), want a short error without the URL", row.LastFetchError, len(row.LastFetchError))
+	}
+}
+
+func TestDoFetchSubscriptionLinksRefusesTooManyLinks(t *testing.T) {
+	allowLoopbackProvider(t)
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(strings.Repeat("trojan://p@a:1\n", subscriptionMaxLinks+1)))
+	}))
+	defer srv.Close()
+	if links, err := doFetchSubscriptionLinks(srv.URL); !errors.Is(err, errSubscriptionTooManyLinks) || links != nil {
+		t.Fatalf("fetch = %d links, %v; want errSubscriptionTooManyLinks", len(links), err)
+	}
+}

internal/sub/json_service.go

@@ -268,7 +268,7 @@ func (s *SubJsonService) GetJson(subId string, host string, alwaysReturnArray bo
 			maps.Copy(newConfigJson, s.bakedTemplate())
 			newConfigJson["outbounds"] = newOutbounds
 			newConfigJson["remarks"] = remark
-			newConfig, _ := json.MarshalIndent(newConfigJson, "", "  ")
+			newConfig, _ := json.Marshal(newConfigJson)
 			configArray = append(configArray, newConfig)
 		}
 	}