MHSanaei 33b029e1ca fix(security): confine GetCertHash to known cert files (CWE-22) ...

Resolve CodeQL go/path-injection (alert #96): the certFile path from
the getCertHash endpoint flowed straight into os.ReadFile, letting an
authenticated request read arbitrary files by path. Validate it against
an allow-list of certificate files the panel already references (inbound
TLS certificateFile values plus the panel's own web cert) and read the
config-sourced path rather than the caller-supplied one, breaking the
taint flow while preserving arbitrary cert locations.

2026-06-21 17:56:17 +02:00

..

config

Test-quality audit: fix 2 prod bugs, strengthen weak tests, add mutation/fuzz/CI tooling (#5345)

2026-06-15 15:17:03 +02:00

database

feat(tls,reality): port xray TLS/REALITY fields, cert-hash helpers, fallback UX

2026-06-21 15:58:42 +02:00

eventbus

feat(memory): add memory threshold alerts (#5366)

2026-06-21 17:45:33 +02:00

logger

refactor(frontend): move form-item hints from extra to tooltip

2026-06-17 17:24:16 +02:00

mtproto

refactor(frontend): move form-item hints from extra to tooltip

2026-06-17 17:24:16 +02:00

sub

feat(tls,reality): port xray TLS/REALITY fields, cert-hash helpers, fallback UX

2026-06-21 15:58:42 +02:00

util

fix(sub): SS2022 share links must not base64-encode userinfo (#5432)

2026-06-20 11:25:12 +02:00

web

fix(security): confine GetCertHash to known cert files (CWE-22)

2026-06-21 17:56:17 +02:00

xray

fix(xray): guard log-writer race and bound handler gRPC deadlines (#5442)

2026-06-20 18:10:18 +02:00