xinyin025/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-09-27 20:26:42 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(panel): validate sponsor logo name before any file or network use

Browse Source 
The public /sponsors/logo/:name route only accepted names matching an
active sponsor's logo, which was already regex-filtered, but that guard
was indirect. Checking sponsorLogoRe on the name itself makes the
path/URL safety local and clears CodeQL alerts #113 (go/request-forgery)
and #114 (go/path-injection).
This commit is contained in:
MHSanaei
2026-09-26 12:40:31 +02:00
parent fd7b3559bc
commit dcaadd4857
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/web/service/panel/sponsor.go
+4
View File
@@ -110,6 +110,10 @@ func cachedSponsors() (*SponsorList, error) {
// GetSponsorLogo returns the image bytes for a logo of a currently active sponsor. // GetSponsorLogo returns the image bytes for a logo of a currently active sponsor.
func (s *PanelService) GetSponsorLogo(name string) ([]byte, string, error) { func (s *PanelService) GetSponsorLogo(name string) ([]byte, string, error) {
// Validated here, not only via list membership, so name can never carry a path or URL.
if !sponsorLogoRe.MatchString(name) {
return nil, "", ErrSponsorLogoUnknown
}
sponsors, err := s.GetSponsors() sponsors, err := s.GetSponsors()
if err != nil { if err != nil {
return nil, "", err return nil, "", err