pjandro/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-11-03 19:55:04 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(xray): bound what the in-process config loader is asked to expand

Browse Source 
The panel runs xray-core's conf.Build() in its own process on inbounds
and on outbounds that come from pushes and subscriptions. Some values
make it allocate or loop without bound (an XHTTP sessionIDLength, udphop
port lists, any number of finalmask entries, each xmc one costing an RSA
key), and certificate paths are read whole whatever they name.

Refuse those before any build: sessionIDLength above 1024, more than one
port range's worth of udphop ports per stream, more than 16 masks per
stream, more than 64 xmc masks per outbound subscription, and certificate
or key files that are not regular files of at most 1 MiB. Inbound saves,
the TUIC readers and the certificate-pin helper apply the file rule too;
the pin helper also stops looking at paths that name files on a node.
This commit is contained in:
MHSanaei
2026-10-31 08:43:30 +00:00
parent db20e491e6
commit 61ee202750
12 changed files with 390 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/web/service/inbound.go
+18
View File
@@ -713,6 +713,18 @@ func canonicalizeStreamNetworkKey(streamSettings string) string {
return string(out)
}
// validateInboundBuildInput refuses what xray-core's in-process build would expand without
// bound; certificate paths are checked only where this host is the one opening them.
func validateInboundBuildInput(inbound *model.Inbound) error {
if err := xray.CheckStreamBuildCost([]byte(inbound.StreamSettings)); err != nil {
return err
}
if inbound.NodeID != nil {
return nil
}
return xray.CheckConfigCertFiles([]byte(inbound.StreamSettings))
}
// validateInboundTLSCertificates rejects incomplete TLS credentials before a save
// can restart Xray. File paths belong to the node, so only presence is checked.
func validateInboundTLSCertificates(streamSettings string) error {
@@ -1290,6 +1302,9 @@ func (s *InboundService) AddInbound(inbound *model.Inbound) (*model.Inbound, boo
return inbound, false, err
}
}
if err := validateInboundBuildInput(inbound); err != nil {
return inbound, false, err
}
if err := validateFinalMaskRealityCombo(inbound.StreamSettings); err != nil {
return inbound, false, err
}
@@ -2007,6 +2022,9 @@ func (s *InboundService) UpdateInbound(inbound *model.Inbound) (*model.Inbound,
}
inbound.SubSortIndex = normalizeSubSortIndex(inbound.SubSortIndex)
if err := validateInboundBuildInput(inbound); err != nil {
return inbound, false, err
}
// Grandfather a row that was already stored incomplete so it stays editable;
// only a save that breaks a previously valid TLS block is refused.
if !s.FromNodeSync {