MHSanaei 6b89613ad7 fix(security): dial outbound subscriptions through the SSRF guard ...

The outbound-subscription fetch validated the URL host once (resolving DNS and
rejecting private targets) but then fetched with a plain HTTP client that
re-resolves the host at dial time, so a subscription domain the attacker controls
could pass validation as a public IP and rebind to 127.0.0.1 / a cloud metadata
endpoint / an internal host for the actual dial — a blind SSRF into the panel's
network. Route the direct fetch (and its redirects) through
netsafe.SSRFGuardedDialContext, which resolves, checks and dials the same IP
atomically, carrying the subscription's AllowPrivate flag on the request context;
a configured egress proxy still dials its loopback bridge unguarded.

2026-07-15 04:07:04 +02:00

..

config

v3.5.0

2026-07-12 22:08:19 +02:00

database

fix(db): mark the IP-limit cleanup seeder done on a fresh install

2026-07-15 03:52:15 +02:00

eventbus

style: adopt golangci-lint v2 and resolve all findings

2026-06-27 15:42:22 +02:00

logger

fix(inbounds): apply runtime changes after the DB commit (#5768)

2026-07-08 22:12:28 +02:00

mtproto

refactor: modernize Go with strings.SplitSeq and maps.Copy

2026-07-08 22:10:54 +02:00

sub

fix(sub): drop empty remark segments instead of leaving a stray separator

2026-07-15 02:56:42 +02:00

tunnelmonitor

style: adopt golangci-lint v2 and resolve all findings

2026-06-27 15:42:22 +02:00

util

fix(link): honor the vmess ws path and hysteria2 vcn params on import

2026-07-15 02:52:09 +02:00

web

fix(security): dial outbound subscriptions through the SSRF guard

2026-07-15 04:07:04 +02:00

xray

fix(xray): synchronize the process version and apiPort fields

2026-07-15 03:33:38 +02:00