xinyin025/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-09-16 15:17:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(sub): prevent default profile page URL disclosure (#6538)

Browse Source 
* fix(sub): prevent default profile page URL disclosure

Add explicit none, builtin, and custom profile page modes.
Preserve existing custom URLs and warn before exposing the built-in page.
Cover mode selection, legacy settings, and subscription response headers.

* fix(subscription): add profile page link options and upgrade notes
This commit is contained in:
NgaiYeanCoi
2026-09-16 03:13:29 +08:00
committed by GitHub
parent 3fa44915c1
commit 1d85ef138e
36 changed files with 747 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/sub/controller.go
+16 -6
View File
@@ -53,6 +53,7 @@ type cachedSubTemplate struct {
type SUBController struct {
subTitle string
subSupportUrl string
subProfileMode string
subProfileUrl string
subAnnounce string
subEnableRouting bool
@@ -115,6 +116,7 @@ type subControllerConfig struct {
subTitle string
subSupportURL string
subProfileMode string
subProfileURL string
subAnnounce string
subEnableRouting bool
@@ -224,6 +226,10 @@ func WithSUBProfileURL(value string) SUBControllerOption {
return func(config *subControllerConfig) { config.subProfileURL = value }
}
func WithSUBProfileMode(value string) SUBControllerOption {
return func(config *subControllerConfig) { config.subProfileMode = value }
}
func WithSUBAnnounce(value string) SUBControllerOption {
return func(config *subControllerConfig) { config.subAnnounce = value }
}
@@ -260,6 +266,7 @@ func defaultSUBControllerConfig() subControllerConfig {
subEncrypt: true,
remarkTemplate: service.DefaultRemarkTemplate,
updateInterval: "12",
subProfileMode: service.SubProfileModeNone,
}
}
@@ -277,6 +284,7 @@ func NewSUBController(g *gin.RouterGroup, options ...SUBControllerOption) *SUBCo
a := &SUBController{
subTitle: config.subTitle,
subSupportUrl: config.subSupportURL,
subProfileMode: config.subProfileMode,
subProfileUrl: config.subProfileURL,
subAnnounce: config.subAnnounce,
subEnableRouting: config.subEnableRouting,
@@ -485,8 +493,7 @@ func (a *SUBController) subs(c *gin.Context) {
// Add headers
header := subReq.subscriptionUserinfo(traffic)
profileURL := fmt.Sprintf("%s://%s%s", scheme, hostWithPort, c.Request.RequestURI)
metadata := a.metadataForSubRequest(func() *SubService { return subReq }, subId, profileURL)
metadata := a.metadataForSubRequest(func() *SubService { return subReq }, subId, builtinProfileURL(c, scheme, hostWithPort))
a.ApplyCommonHeaders(c, header, a.updateInterval, metadata.Title, metadata.SupportURL, metadata.ProfileURL, metadata.Announce, a.subEnableRouting, a.subRoutingRules, a.subHideSettings)
if a.subIncyEnableRouting && a.subIncyRoutingRules != "" {
@@ -818,14 +825,13 @@ func (a *SUBController) serveJsonBody(c *gin.Context, alwaysReturnArray bool, co
if len(jsonSub) == 0 && header == "" {
return false
}
profileURL := fmt.Sprintf("%s://%s%s", scheme, hostWithPort, c.Request.RequestURI)
var subReq *SubService
metadata := a.metadataForSubRequest(func() *SubService {
if subReq == nil {
subReq = a.subService.ForRequest(host)
}
return subReq
}, subId, profileURL)
}, subId, builtinProfileURL(c, scheme, hostWithPort))
a.ApplyCommonHeaders(c, header, a.updateInterval, metadata.Title, metadata.SupportURL, metadata.ProfileURL, metadata.Announce, a.subEnableRouting, a.subRoutingRules, a.subHideSettings)
if rawDownload {
c.Writer.Header().Set("Content-Disposition", `attachment; filename="subscription.json"`)
@@ -887,14 +893,13 @@ func (a *SUBController) serveClashBody(c *gin.Context, rawDownload bool, legacy
if len(clashSub) == 0 && header == "" {
return false
}
profileURL := fmt.Sprintf("%s://%s%s", scheme, hostWithPort, c.Request.RequestURI)
var subReq *SubService
metadata := a.metadataForSubRequest(func() *SubService {
if subReq == nil {
subReq = a.subService.ForRequest(host)
}
return subReq
}, subId, profileURL)
}, subId, builtinProfileURL(c, scheme, hostWithPort))
a.ApplyCommonHeaders(c, header, a.updateInterval, metadata.Title, metadata.SupportURL, metadata.ProfileURL, metadata.Announce, a.subEnableRouting, a.subRoutingRules, a.subHideSettings)
if rawDownload {
c.Writer.Header().Set("Content-Disposition", `attachment; filename="subscription.yaml"`)
@@ -906,6 +911,11 @@ func (a *SUBController) serveClashBody(c *gin.Context, rawDownload bool, legacy
return true
}
func builtinProfileURL(c *gin.Context, scheme, hostWithPort string) string {
// Drop download/format selectors so the opt-in link always opens the HTML page.
return fmt.Sprintf("%s://%s%s?html=1", scheme, hostWithPort, c.Request.URL.EscapedPath())
}
// ApplyCommonHeaders sets common HTTP headers for subscription responses including user info, update interval, and profile title.
func (a *SUBController) ApplyCommonHeaders(
c *gin.Context,
internal/sub/placeholders.go
+12 -8
View File
@@ -10,6 +10,7 @@ import (
"github.com/mhsanaei/3x-ui/v3/internal/database"
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
"github.com/mhsanaei/3x-ui/v3/internal/logger"
"github.com/mhsanaei/3x-ui/v3/internal/web/service"
)
type subPlaceholderData struct {
@@ -76,10 +77,17 @@ func subMetadataUsesPlaceholders(values ...string) bool {
return false
}
func (a *SUBController) metadataForSubRequest(getSubReq func() *SubService, subID string, fallbackProfileURL string) renderedSubMetadata {
func (a *SUBController) metadataForSubRequest(getSubReq func() *SubService, subID, builtinURL string) renderedSubMetadata {
profileURL := ""
switch a.subProfileMode {
case service.SubProfileModeBuiltin:
profileURL = builtinURL
case service.SubProfileModeCustom:
profileURL = strings.TrimSpace(a.subProfileUrl)
}
var context remarkContext
var hasContext bool
if subMetadataUsesPlaceholders(a.subTitle, a.subSupportUrl, a.subProfileUrl, a.subAnnounce) {
if subMetadataUsesPlaceholders(a.subTitle, a.subSupportUrl, profileURL, a.subAnnounce) {
var err error
subReq := getSubReq()
context, hasContext, err = subReq.subscriptionTemplateContextBySubID(subID)
@@ -87,12 +95,8 @@ func (a *SUBController) metadataForSubRequest(getSubReq func() *SubService, subI
logger.Warning("sub: load template contexts for subscription metadata:", err)
}
}
profileURL := a.subProfileUrl
if profileURL == "" {
profileURL = fallbackProfileURL
} else {
profileURL = renderSubPlaceholders(profileURL, subPlaceholderData{SubID: subID, Context: context, HasCtx: hasContext, Escape: true})
}
// Disabled modes ignore the retained custom URL and never fall back to the request URL.
profileURL = renderSubPlaceholders(profileURL, subPlaceholderData{SubID: subID, Context: context, HasCtx: hasContext, Escape: true})
data := subPlaceholderData{SubID: subID, Context: context, HasCtx: hasContext}
return renderedSubMetadata{
Title: renderSubPlaceholders(a.subTitle, data),
internal/sub/placeholders_test.go
+72 -11
View File
@@ -1,10 +1,15 @@
package sub
import (
"net/http"
"net/http/httptest"
"testing"
"github.com/gin-gonic/gin"
"github.com/mhsanaei/3x-ui/v3/internal/database"
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
"github.com/mhsanaei/3x-ui/v3/internal/web/service"
)
func TestRenderSubPlaceholders(t *testing.T) {
@@ -68,20 +73,75 @@ func TestRenderSubPlaceholders(t *testing.T) {
}
}
func TestMetadataForSubRequestDoesNotExpandFallbackProfileURL(t *testing.T) {
func TestMetadataForSubRequestOmitsUnconfiguredProfileURL(t *testing.T) {
a := &SUBController{
subTitle: "isVPN",
subSupportUrl: "https://support.example/",
}
fallback := "https://sub.example.com/sub/sub-123?x={{EMAIL}}"
metadata := a.metadataForSubRequest(func() *SubService {
t.Fatal("metadataForSubRequest loaded a subscription context without configured placeholders")
return nil
}, "sub-123", fallback)
}, "sub-123", "https://sub.example/sub-123")
if metadata.ProfileURL != fallback {
t.Fatalf("ProfileURL = %q, want untouched fallback %q", metadata.ProfileURL, fallback)
if metadata.ProfileURL != "" {
t.Fatalf("ProfileURL = %q, want no link when unconfigured", metadata.ProfileURL)
}
}
func TestSubscriptionProfileURLRequiresExplicitConfiguration(t *testing.T) {
gin.SetMode(gin.TestMode)
initSubDB(t)
seedInfoEndpointSub(t, "profile-sub", "profile@example.com")
for _, config := range []struct {
name, profileURL, want string
}{
{name: "empty"},
{name: "whitespace", profileURL: " "},
{name: "explicit", profileURL: "https://portal.example.com/account", want: "https://portal.example.com/account"},
{name: "template", profileURL: "https://portal.example.com/account?sub={{SUB_ID}}", want: "https://portal.example.com/account?sub=profile-sub"},
} {
t.Run(config.name, func(t *testing.T) {
for _, client := range []struct {
name, userAgent string
happAutoDetect bool
}{
{name: "Happ", userAgent: "Happ/3.22.0 (Android)", happAutoDetect: true},
{name: "Happ without auto-detection", userAgent: "Happ/3.22.0 (Android)"},
{name: "standard", userAgent: "v2rayNG/1.8.5", happAutoDetect: true},
} {
t.Run(client.name, func(t *testing.T) {
// All formats must honor the opt-in, independently of Happ customization.
router := gin.New()
NewSUBController(router.Group("/"),
WithSUBJsonEnabled(true), WithSUBClashEnabled(true),
WithSUBProfileURL(config.profileURL),
WithSUBProfileMode(service.SubProfileModeCustom),
WithSUBHappConfig(HappConfig{AutoDetect: client.happAutoDetect}),
)
for _, path := range []string{"/sub/profile-sub", "/json/profile-sub", "/clash/profile-sub"} {
t.Run(path, func(t *testing.T) {
req := httptest.NewRequest(http.MethodGet, path, nil)
req.Host = "sub.example.com"
req.Header.Set("User-Agent", client.userAgent)
resp := httptest.NewRecorder()
router.ServeHTTP(resp, req)
if resp.Code != http.StatusOK {
t.Fatalf("status = %d, want 200; body=%s", resp.Code, resp.Body.String())
}
if got := resp.Header().Get("Profile-Web-Page-Url"); got != config.want {
t.Fatalf("Profile-Web-Page-Url = %q, want %q", got, config.want)
}
if config.want == "" {
if _, present := resp.Header()["Profile-Web-Page-Url"]; present {
t.Fatal("unconfigured profile header must be omitted")
}
}
})
}
})
}
})
}
}
@@ -110,12 +170,13 @@ func TestMetadataForSubRequestUsesStableClientIdentity(t *testing.T) {
}
a := &SUBController{
subTitle: "isVPN — {{EMAIL}}",
subSupportUrl: "https://support.example/?email={{EMAIL}}&tg={{TELEGRAM_ID}}",
subProfileUrl: "https://profile.example/account/{{ID}}",
subAnnounce: "Subscription {{SUB_ID}}",
subTitle: "isVPN — {{EMAIL}}",
subSupportUrl: "https://support.example/?email={{EMAIL}}&tg={{TELEGRAM_ID}}",
subProfileUrl: "https://profile.example/account/{{ID}}",
subProfileMode: service.SubProfileModeCustom,
subAnnounce: "Subscription {{SUB_ID}}",
}
metadata := a.metadataForSubRequest(func() *SubService { return &SubService{} }, "sub-123", "https://fallback.example/{{EMAIL}}")
metadata := a.metadataForSubRequest(func() *SubService { return &SubService{} }, "sub-123", "https://sub.example/sub-123")
if metadata.Title != "isVPN — john doe@example.com" {
t.Fatalf("Title = %q", metadata.Title)
internal/sub/profile_mode_test.go
+97
View File
@@ -0,0 +1,97 @@
package sub
import (
"net/http"
"net/http/httptest"
"strings"
"testing"
"github.com/gin-gonic/gin"
"github.com/mhsanaei/3x-ui/v3/internal/database"
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
)
func TestSubscriptionProfileModesFromSavedSettings(t *testing.T) {
oldFS, oldMode := distFS, gin.Mode()
oldWriter, oldErrorWriter := gin.DefaultWriter, gin.DefaultErrorWriter
SetDistFS(testDistFS)
t.Cleanup(func() {
SetDistFS(oldFS)
gin.SetMode(oldMode)
gin.DefaultWriter, gin.DefaultErrorWriter = oldWriter, oldErrorWriter
})
for _, config := range []struct {
name, mode, profileURL, want string
}{
{name: "new installation"},
{name: "legacy whitespace", profileURL: " "},
{name: "legacy custom", profileURL: "https://portal.example/account", want: "https://portal.example/account"},
{name: "none retains custom", mode: "none", profileURL: "https://portal.example/account"},
{name: "builtin", mode: "builtin", profileURL: "https://portal.example/account"},
{name: "custom", mode: "custom", profileURL: "https://portal.example/?sub={{SUB_ID}}", want: "https://portal.example/?sub=profile-sub"},
{name: "empty custom", mode: "custom"},
{name: "invalid mode", mode: "invalid", profileURL: "https://portal.example/account"},
} {
t.Run(config.name, func(t *testing.T) {
initSubDB(t)
seedInfoEndpointSub(t, "profile-sub", "profile@example.com")
settings := []model.Setting{
{Key: "subPath", Value: "/sub/"},
{Key: "subJsonPath", Value: "/json/"},
{Key: "subClashPath", Value: "/clash/"},
{Key: "subJsonEnable", Value: "true"},
{Key: "subClashEnable", Value: "true"},
{Key: "subProfileUrl", Value: config.profileURL},
}
if config.mode != "" {
settings = append(settings, model.Setting{Key: "subProfileMode", Value: config.mode})
}
for _, setting := range settings {
if err := database.GetDB().Where("key = ?", setting.Key).Delete(&model.Setting{}).Error; err != nil {
t.Fatal(err)
}
if err := database.GetDB().Create(&setting).Error; err != nil {
t.Fatal(err)
}
}
router, err := (&Server{}).initRouter()
if err != nil {
t.Fatal(err)
}
for _, path := range []string{"/sub/profile-sub", "/json/profile-sub", "/clash/profile-sub", "/json/profile-sub?view=raw", "/clash/profile-sub?view=raw", "/mihomo/profile-sub"} {
for _, userAgent := range []string{"Happ/3.22.0 (Android)", "v2rayNG/1.8.5"} {
t.Run(path+"/"+userAgent, func(t *testing.T) {
req := httptest.NewRequest(http.MethodGet, "https://sub.example.com:8443"+path, nil)
req.Header.Set("User-Agent", userAgent)
resp := httptest.NewRecorder()
router.ServeHTTP(resp, req)
if resp.Code != http.StatusOK {
t.Fatalf("status = %d; body=%s", resp.Code, resp.Body.String())
}
want := config.want
if config.mode == "builtin" {
want = "https://sub.example.com:8443" + req.URL.EscapedPath() + "?html=1"
}
if got := resp.Header().Get("Profile-Web-Page-Url"); got != want {
t.Fatalf("Profile-Web-Page-Url = %q, want %q", got, want)
}
if want == "" {
if _, present := resp.Header()["Profile-Web-Page-Url"]; present {
t.Fatal("disabled profile header must be absent")
}
}
if config.mode == "builtin" {
// The restored link must open the page, even when copied from a raw download.
page := httptest.NewRecorder()
router.ServeHTTP(page, httptest.NewRequest(http.MethodGet, want, nil))
if page.Code != http.StatusOK || !strings.Contains(page.Header().Get("Content-Type"), "text/html") {
t.Fatalf("builtin link did not serve HTML: status=%d, type=%q", page.Code, page.Header().Get("Content-Type"))
}
}
})
}
}
})
}
}
internal/sub/sub.go
+5
View File
@@ -194,6 +194,10 @@ func (s *Server) initRouter() (*gin.Engine, error) {
if err != nil {
SubProfileUrl = ""
}
SubProfileMode, err := s.settingService.GetSubProfileMode()
if err != nil {
SubProfileMode = service.SubProfileModeNone
}
SubAnnounce, err := s.settingService.GetSubAnnounce()
if err != nil {
@@ -329,6 +333,7 @@ func (s *Server) initRouter() (*gin.Engine, error) {
WithSUBTitle(SubTitle),
WithSUBSupportURL(SubSupportUrl),
WithSUBProfileURL(SubProfileUrl),
WithSUBProfileMode(SubProfileMode),
WithSUBAnnounce(SubAnnounce),
WithSUBEnableRouting(SubEnableRouting),
WithSUBRoutingRules(SubRoutingRules),