fix(sub): don't leak loopback bind IP into link host

When the sub server is reached on a loopback/unspecified host (e.g. 127.0.0.2 from its Listen IP bind), the request host was used as the link address. Substitute the configured Subscription/Web Domain, or normalize loopback to localhost, so the sub link address matches the panel's Client Information.
2026-07-16 17:46:08 +00:00 · 2026-05-31 03:34:17 +02:00
parent 234cce408b
commit 3f6fe1167d
2 changed files with 47 additions and 0 deletions
@@ -46,6 +46,21 @@ func TestFindClientIndex(t *testing.T) {
 	}
 }

+func TestIsRoutableHost(t *testing.T) {
+	routable := []string{"example.com", "sub.example.com", "10.0.0.1", "192.168.1.5", "1.2.3.4", "2001:db8::1"}
+	for _, v := range routable {
+		if !isRoutableHost(v) {
+			t.Fatalf("isRoutableHost(%q) = false, want true", v)
+		}
+	}
+	notRoutable := []string{"", "0.0.0.0", "::", "::0", "127.0.0.1", "127.0.0.2", "::1", "[::1]"}
+	for _, v := range notRoutable {
+		if isRoutableHost(v) {
+			t.Fatalf("isRoutableHost(%q) = true, want false", v)
+		}
+	}
+}
+
 func TestUnmarshalStreamSettings(t *testing.T) {
 	got := unmarshalStreamSettings(`{"network":"ws","wsSettings":{"path":"/api"}}`)
 	if got["network"] != "ws" {