fix(xray): bound what the in-process config loader is asked to expand

The panel runs xray-core's conf.Build() in its own process on inbounds
and on outbounds that come from pushes and subscriptions. Some values
make it allocate or loop without bound (an XHTTP sessionIDLength, udphop
port lists, any number of finalmask entries, each xmc one costing an RSA
key), and certificate paths are read whole whatever they name.

Refuse those before any build: sessionIDLength above 1024, more than one
port range's worth of udphop ports per stream, more than 16 masks per
stream, more than 64 xmc masks per outbound subscription, and certificate
or key files that are not regular files of at most 1 MiB. Inbound saves,
the TUIC readers and the certificate-pin helper apply the file rule too;
the pin helper also stops looking at paths that name files on a node.

internal/web/service/inbound.go

@@ -713,6 +713,18 @@ func canonicalizeStreamNetworkKey(streamSettings string) string {
 	return string(out)
 }
 
+// validateInboundBuildInput refuses what xray-core's in-process build would expand without
+// bound; certificate paths are checked only where this host is the one opening them.
+func validateInboundBuildInput(inbound *model.Inbound) error {
+	if err := xray.CheckStreamBuildCost([]byte(inbound.StreamSettings)); err != nil {
+		return err
+	}
+	if inbound.NodeID != nil {
+		return nil
+	}
+	return xray.CheckConfigCertFiles([]byte(inbound.StreamSettings))
+}
+
 // validateInboundTLSCertificates rejects incomplete TLS credentials before a save
 // can restart Xray. File paths belong to the node, so only presence is checked.
 func validateInboundTLSCertificates(streamSettings string) error {
@@ -1290,6 +1302,9 @@ func (s *InboundService) AddInbound(inbound *model.Inbound) (*model.Inbound, boo
 			return inbound, false, err
 		}
 	}
+	if err := validateInboundBuildInput(inbound); err != nil {
+		return inbound, false, err
+	}
 	if err := validateFinalMaskRealityCombo(inbound.StreamSettings); err != nil {
 		return inbound, false, err
 	}
@@ -2007,6 +2022,9 @@ func (s *InboundService) UpdateInbound(inbound *model.Inbound) (*model.Inbound,
 	}
 	inbound.SubSortIndex = normalizeSubSortIndex(inbound.SubSortIndex)
 
+	if err := validateInboundBuildInput(inbound); err != nil {
+		return inbound, false, err
+	}
 	// Grandfather a row that was already stored incomplete so it stays editable;
 	// only a save that breaks a previously valid TLS block is refused.
 	if !s.FromNodeSync {

internal/web/service/inbound_tls_test.go

@@ -1,6 +1,7 @@
 package service
 
 import (
+	"path/filepath"
 	"reflect"
 	"strings"
 	"testing"
@@ -183,3 +184,34 @@ func TestUpdateInboundAllowsUntouchedLegacyTLSCertificates(t *testing.T) {
 		})
 	}
 }
+
+// A push names any path on this host, and xray-core reads it whole in the panel process
+// (a device never ends, /dev/zero never stops growing), so it is refused before storing.
+func TestAddInboundRefusesACertificatePathThatIsNoRegularFile(t *testing.T) {
+	setupConflictDB(t)
+	mgr := useTestRuntimeManager(t)
+	fake := &fakeNodeRuntime{}
+	mgr.SetLocalRuntimeOverride(fake)
+
+	dir := filepath.ToSlash(t.TempDir())
+	inbound := &model.Inbound{
+		Tag:            "tls-device-44311",
+		Enable:         true,
+		Listen:         "0.0.0.0",
+		Port:           44311,
+		Protocol:       model.VLESS,
+		StreamSettings: `{"network":"tcp","security":"tls","tlsSettings":{"certificates":[{"certificateFile":"` + dir + `","KeyFile":"` + dir + `"}]}}`,
+		Settings:       `{"clients":[]}`,
+	}
+	_, _, err := (&InboundService{FromNodeSync: true}).AddInbound(inbound)
+	if err == nil || !strings.Contains(err.Error(), "regular file") {
+		t.Fatalf("AddInbound = %v, want the certificate path refused", err)
+	}
+	var count int64
+	if err := database.GetDB().Model(&model.Inbound{}).Count(&count).Error; err != nil || count != 0 {
+		t.Fatalf("refused push stored %d row(s) (%v)", count, err)
+	}
+	if fake.addInbound.Load() != 0 {
+		t.Fatal("refused push reached the runtime")
+	}
+}

internal/web/service/outbound_subscription.go

@@ -486,9 +486,14 @@ func (s *OutboundSubscriptionService) fetchOutbounds(sub *model.OutboundSubscrip
 	// persisted (filtered) list, so positions must be counted in that same list.
 	var dropped []string
 	ownPorts := xrayOwnPorts()
+	xmcBudget := maxSubscriptionXMCMasks
 	keptLinks, keptIdentities := parsed[:0], identities[:0]
 	for i, ob := range parsed {
-		if reason := internalDialTarget(map[string]any(ob), sub.AllowPrivate, ownPorts); reason != "" {
+		reason := internalDialTarget(map[string]any(ob), sub.AllowPrivate, ownPorts)
+		if reason == "" && !spendXMCBudget(map[string]any(ob), &xmcBudget) {
+			reason = fmt.Sprintf("the subscription uses more than %d xmc masks", maxSubscriptionXMCMasks)
+		}
+		if reason != "" {
 			logger.Warningf("outbound sub %d: dropping outbound %.64q: %s", sub.Id, ob["tag"], reason)
 			dropped = append(dropped, fmt.Sprintf("%.64s: %s", ob["tag"], reason))
 			continue
@@ -531,6 +536,27 @@ func (s *OutboundSubscriptionService) fetchOutbounds(sub *model.OutboundSubscrip
 	return fetched, nil
 }
 
+// maxSubscriptionXMCMasks bounds the RSA keys one subscription costs the core per build;
+// the masks can be spread over links, so a per-stream cap alone does not bound it.
+const maxSubscriptionXMCMasks = 64
+
+func spendXMCBudget(outbound any, budget *int) bool {
+	ob, ok := outbound.(map[string]any)
+	if !ok {
+		return true
+	}
+	stream, err := json.Marshal(ob["streamSettings"])
+	if err != nil {
+		return true
+	}
+	n := xray.CountXMCMasks(stream)
+	if n > *budget {
+		return false
+	}
+	*budget -= n
+	return true
+}
+
 // withoutRequestURL keeps only the host of the URL net/url and net/http quote in their
 // errors: a subscription URL is a credential, and these errors are logged and stored.
 func withoutRequestURL(err error) error {
@@ -652,6 +678,7 @@ func (s *OutboundSubscriptionService) activeOutboundsSplit() (prepend []any, app
 	}
 	ownPorts := xrayOwnPorts()
 	for _, sub := range subs {
+		xmcBudget := maxSubscriptionXMCMasks
 		if strings.TrimSpace(sub.LastFetchedOutbounds) == "" {
 			continue
 		}
@@ -663,6 +690,9 @@ func (s *OutboundSubscriptionService) activeOutboundsSplit() (prepend []any, app
 		// Rows stored before the fetch refused these, or while allowPrivate was on.
 		arr = slices.DeleteFunc(arr, func(ob any) bool {
 			reason := internalDialTarget(ob, sub.AllowPrivate, ownPorts)
+			if reason == "" && !spendXMCBudget(ob, &xmcBudget) {
+				reason = "over the subscription's xmc mask budget"
+			}
 			if reason != "" {
 				logger.Warningf("outbound sub %d: dropping a stored outbound: %s", sub.Id, reason)
 			}

internal/web/service/outbound_subscription_test.go

@@ -695,3 +695,25 @@ func TestOutboundSubscriptionCreateKeepsItDisabled(t *testing.T) {
 		t.Fatalf("stored enabled = %v (%v), want the subscription created disabled", stored.Enabled, err)
 	}
 }
+
+// The core derives an RSA key per xmc mask on every build, so the masks a document may
+// spread over its links are budgeted per subscription, before anything is built.
+func TestOutboundSubscriptionRefreshCapsXMCMasks(t *testing.T) {
+	setupSettingTestDB(t)
+	const xmc = `{"type":"xmc","settings":{"password":"p","profiles":[{"username":"abc","uuid":"00000000-0000-0000-0000-000000000000","texturesValue":"a","texturesSignature":"a"}]}}`
+	server := func(address string, masks ...string) string {
+		return "vless://00000000-0000-4000-8000-000000000000@" + address + ":443?security=tls&type=tcp&fm=" +
+			url.QueryEscape(`{"tcp":[`+strings.Join(masks, ",")+`]}`) + "#" + address + "\n"
+	}
+	four := []string{xmc, xmc, xmc, xmc}
+	subID := serveOutboundSubscription(t, "p-", func(int) string {
+		return server("1.1.1.1", slices.Repeat([]string{xmc}, 400)...) +
+			strings.Repeat(server("1.1.1.3", four...), maxSubscriptionXMCMasks/4) +
+			server("1.1.1.4", xmc) +
+			server("1.1.1.5", `{"type":"sudoku","settings":{"password":"p"}}`)
+	})
+	tags, byAddress := refreshOutboundTags(t, subID)
+	if _, plain := byAddress["1.1.1.5"]; len(tags) != maxSubscriptionXMCMasks/4+1 || len(byAddress) != 2 || !plain {
+		t.Fatalf("kept %d outbounds, tags by address = %v", len(tags), byAddress)
+	}
+}

internal/web/service/server.go

@@ -2687,6 +2687,9 @@ func (s *ServerService) GetCertHash(certFile string, certContent string) ([]stri
 		if !ok {
 			return nil, common.NewError("certificate file is not referenced by any inbound or panel setting")
 		}
+		if err := xray.CheckCertFile(known); err != nil {
+			return nil, err
+		}
 		b, err := os.ReadFile(known)
 		if err != nil {
 			return nil, err
@@ -2760,6 +2763,10 @@ func (s *ServerService) knownCertFiles() []string {
 	}
 	if inbounds, err := s.inboundService.GetAllInbounds(); err == nil {
 		for _, inbound := range inbounds {
+			// A node row's path names a file on the node's host, not on this one.
+			if inbound.NodeID != nil {
+				continue
+			}
 			files = collectCertFiles(inbound.StreamSettings, files)
 		}
 	}

internal/web/service/server_remote_cert_hash_test.go

@@ -6,9 +6,14 @@ import (
 	"errors"
 	"net/http"
 	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strconv"
 	"strings"
 	"testing"
 
+	"github.com/mhsanaei/3x-ui/v3/internal/database"
+	"github.com/mhsanaei/3x-ui/v3/internal/database/model"
 	"github.com/mhsanaei/3x-ui/v3/internal/util/netsafe"
 )
 
@@ -36,3 +41,22 @@ func TestGetRemoteCertHashGuardsPrivateTargets(t *testing.T) {
 		}
 	})
 }
+
+// A node reports its inbounds' certificate paths; they name files on the node, so the
+// master must not read its own file of that name when the admin asks for a pin.
+func TestGetCertHashIgnoresPathsANodeReports(t *testing.T) {
+	setupSettingTestDB(t)
+	certFile := filepath.Join(t.TempDir(), "cert.pem")
+	if err := os.WriteFile(certFile, []byte("not a certificate"), 0o600); err != nil {
+		t.Fatalf("write cert: %v", err)
+	}
+	nodeID := 1
+	stream := `{"security":"tls","tlsSettings":{"certificates":[{"certificateFile":` + strconv.Quote(certFile) + `}]}}`
+	if err := database.GetDB().Create(&model.Inbound{Tag: "node-in", Port: 44312, Protocol: model.VLESS, NodeID: &nodeID, StreamSettings: stream}).Error; err != nil {
+		t.Fatalf("seed node inbound: %v", err)
+	}
+	_, err := (&ServerService{}).GetCertHash(certFile, "")
+	if err == nil || !strings.Contains(err.Error(), "not referenced") {
+		t.Fatalf("GetCertHash(node-reported path) = %v, want it treated as unknown", err)
+	}
+}