mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-11-02 11:15:03 +03:00
MHSanaei
534afe13ab
A client's external subscription is fetched from a third party on every subscriber refresh, and the fetcher trusted it more than its siblings: - it dialled any address, redirects included; it now goes through the SSRF guard like the outbound subscription and remote routing fetchers; - it forwarded any line containing "://"; it now keeps only server share links, so app deeplinks and plain URLs never reach the subscriber's app; - it bounded the body but not the link count (now 1000) or the headers (now 64 KiB), and stored the raw error, URL included, on every row; the stored error is now host-only and at most 1 KiB. The link parser also refuses links that nest JSON past 16 levels, since the JSON subscription pretty-prints it at quadratic cost, and external configs are marshalled compactly until the final, single indent pass.
36 lines
903 B
Go
36 lines
903 B
Go
package common
|
|
|
|
import (
|
|
"strconv"
|
|
"unicode/utf8"
|
|
)
|
|
|
|
// FormatTraffic formats traffic bytes into human-readable units (B, KB, MB, GB, TB, PB).
|
|
func FormatTraffic(trafficBytes int64) string {
|
|
units := []string{"B", "KB", "MB", "GB", "TB", "PB"}
|
|
unitIndex := 0
|
|
size := float64(trafficBytes)
|
|
|
|
for size >= 1024 && unitIndex < len(units)-1 {
|
|
size /= 1024
|
|
unitIndex++
|
|
}
|
|
return strconv.FormatFloat(size, 'f', 2, 64) + units[unitIndex]
|
|
}
|
|
|
|
// maxStatusTextBytes bounds an error text a third party shapes before it is stored as a
|
|
// row's status; legitimate messages are a line or two.
|
|
const maxStatusTextBytes = 1024
|
|
|
|
// TruncateStatusText cuts s to maxStatusTextBytes on a UTF-8 boundary.
|
|
func TruncateStatusText(s string) string {
|
|
if len(s) <= maxStatusTextBytes {
|
|
return s
|
|
}
|
|
cut := maxStatusTextBytes
|
|
for cut > 0 && !utf8.RuneStart(s[cut]) {
|
|
cut--
|
|
}
|
|
return s[:cut] + "... (truncated)"
|
|
}
|