MHSanaei 11e45e81b6 fix(link): sanitize numeric quicParams taken from a share link's fm= param ...

The fm= finalmask blob was JSON-decoded and attached to streamSettings
verbatim, both by the Go parser (outbound subscriptions) and the
frontend import. Some providers emit duration strings for the strictly
integer quicParams fields (e.g. keepAlivePeriod "10s"), and xray-core
then refuses to load the whole config at startup - one bad subscription
entry took the panel's Xray down on the next refresh. Coerce numeric
strings, convert duration strings to whole seconds, and drop values
that cannot be represented as integers; genuinely string-typed fields
(congestion, bbrProfile, brutalUp/Down, udpHop) pass through untouched.

Closes #5783

2026-07-05 20:16:57 +02:00

..

outbound_fuzz_test.go

Test-quality audit: fix 2 prod bugs, strengthen weak tests, add mutation/fuzz/CI tooling (#5345)

2026-06-15 15:17:03 +02:00

outbound_helpers_test.go

fix(nodes): stop multi-attached client traffic inflating across node inbounds

2026-06-15 19:31:57 +02:00

outbound_test.go

fix(link): sanitize numeric quicParams taken from a share link's fm= param

2026-07-05 20:16:57 +02:00

outbound.go

fix(link): sanitize numeric quicParams taken from a share link's fm= param

2026-07-05 20:16:57 +02:00