MHSanaei 61b59bb868 fix(integration): cap WARP API response body size ...

doWarpRequest read the response with an unbounded io.ReadAll, unlike the
sibling NordVPN client which already caps every read at maxResponseSize.
A hostile panel egress proxy or a MITM on the Cloudflare WARP endpoint
could stream an arbitrarily large body and force the panel into an
unbounded allocation. Wrap the body in an io.LimitReader(maxResponseSize)
to match the NordVPN client.

2026-07-15 04:36:30 +02:00

..

controller

fix(security): bound the login-limiter attempts map

2026-07-15 04:11:22 +02:00

entity

fix(settings): detect a wildcard listen collision between the web and sub ports

2026-07-15 03:48:05 +02:00

global

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

job

fix(node): adopt a node inbound's host overrides into the master

2026-07-11 23:17:57 +02:00

locale

style: adopt golangci-lint v2 and resolve all findings

2026-06-27 15:42:22 +02:00

middleware

fix(web): tighten database restore body-cap exemption (#5609)

2026-06-28 15:00:55 +02:00

network

style: adopt golangci-lint v2 and resolve all findings

2026-06-27 15:42:22 +02:00

runtime

fix(inbound): defer a local MTProto inbound edit's sidecar push until after commit

2026-07-15 00:06:53 +02:00

service

fix(integration): cap WARP API response body size

2026-07-15 04:36:30 +02:00

session

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

translation

fix(email): report a missing sender address from the SMTP connection test

2026-07-14 23:00:24 +02:00

websocket

feat(web): broadcast delta client stats above a snapshot threshold

2026-07-02 16:34:01 +02:00

cadence_test.go

refactor(web): centralize background job cadences (#5269)

2026-06-14 22:50:24 +02:00

web_mtls_test.go

feat(node): node hardening — mTLS, hashed+zstd reconcile transport, per-node net metrics (#5382)

2026-06-16 12:19:33 +02:00

web_mtls.go

feat(node): node hardening — mTLS, hashed+zstd reconcile transport, per-node net metrics (#5382)

2026-06-16 12:19:33 +02:00

web.go

fix(xray): retry a failed pending-restart instead of dropping the config change

2026-07-15 03:27:40 +02:00