mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-11-02 19:25:05 +03:00
MHSanaei
534afe13ab
A client's external subscription is fetched from a third party on every subscriber refresh, and the fetcher trusted it more than its siblings: - it dialled any address, redirects included; it now goes through the SSRF guard like the outbound subscription and remote routing fetchers; - it forwarded any line containing "://"; it now keeps only server share links, so app deeplinks and plain URLs never reach the subscriber's app; - it bounded the body but not the link count (now 1000) or the headers (now 64 KiB), and stored the raw error, URL included, on every row; the stored error is now host-only and at most 1 KiB. The link parser also refuses links that nest JSON past 16 levels, since the JSON subscription pretty-prints it at quadratic cost, and external configs are marshalled compactly until the final, single indent pass.
37 lines
1022 B
Go
37 lines
1022 B
Go
package sub
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"github.com/mhsanaei/3x-ui/v3/internal/database/dbtest"
|
|
"github.com/mhsanaei/3x-ui/v3/internal/web/service"
|
|
)
|
|
|
|
// #6559: the Master panel must send a stable X-HWID when fetching external
|
|
// subscriptions, otherwise an HWID-limited donor answers 404.
|
|
func TestFetchSendsStableHwid(t *testing.T) {
|
|
allowLoopbackProvider(t)
|
|
dbtest.InitDB(t, filepath.Join(t.TempDir(), "x-ui.db"))
|
|
|
|
var gotHwid string
|
|
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
gotHwid = r.Header.Get("X-HWID")
|
|
_, _ = w.Write([]byte("vless://uuid@host:443?security=none#x"))
|
|
}))
|
|
defer srv.Close()
|
|
|
|
res := fetchSubscriptionLinks(srv.URL)
|
|
if res.err != nil {
|
|
t.Fatalf("fetch: %v", res.err)
|
|
}
|
|
if len(res.links) != 1 {
|
|
t.Fatalf("links = %v", res.links)
|
|
}
|
|
if want := service.ExternalSubscriptionHwid(); gotHwid == "" || gotHwid != want {
|
|
t.Fatalf("X-HWID = %q, want the panel's stable %q", gotHwid, want)
|
|
}
|
|
}
|