pjandro/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-11-02 11:15:03 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): cap the client traffic list a master pushes by entry count

Browse Source 
pushClientTraffics decoded the pushed list whole, and each "{}" became a
full traffic row, so a body under the size cap could cost the panel
close to a gigabyte. The list is now decoded entry by entry and refused
past 262144 entries. The capped decoder the node runtime already used
moves to json_util so both share it.
This commit is contained in:
MHSanaei
2026-10-31 14:25:21 +01:00
parent 44a502a407
commit fe5d704d67
5 changed files with 82 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/web/controller/inbound.go
+12 -3
View File
@@ -8,6 +8,7 @@ import (
"github.com/mhsanaei/3x-ui/v3/internal/amneziawgkern"
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
"github.com/mhsanaei/3x-ui/v3/internal/util/json_util"
"github.com/mhsanaei/3x-ui/v3/internal/util/wirecodec"
"github.com/mhsanaei/3x-ui/v3/internal/web/middleware"
"github.com/mhsanaei/3x-ui/v3/internal/web/service"
@@ -395,18 +396,26 @@ func (a *InboundController) resetAllTraffics(c *gin.Context) {
jsonMsg(c, I18nWeb(c, "pages.inbounds.toasts.resetAllTrafficSuccess"), nil)
}
// maxPushedClientTraffics bounds one push: each entry decodes into a whole traffic row.
const maxPushedClientTraffics = 1 << 18
// pushClientTraffics receives a master panel's aggregated per-client usage
// (see InboundService.AcceptGlobalTraffic for the storage semantics).
func (a *InboundController) pushClientTraffics(c *gin.Context) {
var req struct {
MasterGuid string `json:"masterGuid"`
Traffics []*xray.ClientTraffic `json:"traffics"`
MasterGuid string `json:"masterGuid"`
Traffics json.RawMessage `json:"traffics"`
}
if err := c.ShouldBindJSON(&req); err != nil {
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
return
}
if err := a.inboundService.AcceptGlobalTraffic(req.MasterGuid, req.Traffics); err != nil {
traffics, err := json_util.DecodeCappedList[*xray.ClientTraffic](req.Traffics, maxPushedClientTraffics)
if err != nil {
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
return
}
if err := a.inboundService.AcceptGlobalTraffic(req.MasterGuid, traffics); err != nil {
jsonMsg(c, I18nWeb(c, "somethingWentWrong"), err)
return
}
internal/web/controller/inbound_node_sync_test.go
+22
View File
@@ -15,6 +15,7 @@ import (
"github.com/mhsanaei/3x-ui/v3/internal/database/dbtest"
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
"github.com/mhsanaei/3x-ui/v3/internal/util/crypto"
"github.com/mhsanaei/3x-ui/v3/internal/web/locale"
"github.com/mhsanaei/3x-ui/v3/internal/web/runtime"
)
@@ -103,3 +104,24 @@ func TestNodeSyncPushSkipsOperatorTLSGuard(t *testing.T) {
}
})
}
// Each "{}" of the pushed list decodes into a whole traffic row, so a body under the size
// cap could still cost the panel close to a gigabyte; the list is capped by entry count.
func TestPushClientTrafficsCapsTheListByEntryCount(t *testing.T) {
gin.SetMode(gin.TestMode)
dbtest.InitDB(t, filepath.Join(t.TempDir(), "x-ui.db"))
engine := gin.New()
engine.Use(func(c *gin.Context) {
c.Set("I18n", func(_ locale.I18nType, key string, _ ...string) string { return key })
c.Next()
})
NewInboundController(engine.Group("/panel/api/inbounds"))
body := `{"masterGuid":"m","traffics":[` + strings.TrimSuffix(strings.Repeat("{},", maxPushedClientTraffics+1), ",") + `]}`
req := httptest.NewRequest(http.MethodPost, "/panel/api/inbounds/pushClientTraffics", strings.NewReader(body))
req.Header.Set("Content-Type", "application/json")
w := httptest.NewRecorder()
engine.ServeHTTP(w, req)
if !strings.Contains(w.Body.String(), `"success":false`) {
t.Fatalf("an over-long traffic list was accepted: %.200s", w.Body.String())
}
}