Addresses audit findings H1, M1, M2.
SSRF (M1): mergeExternalSubscriptionLinks fetched operator-supplied
external-subscription URLs with a plain http.Client — no SSRF protection,
unlike the cluster sync path. An admin could target cloud-metadata
endpoints (169.254.169.254) or probe the internal network from the
server's vantage. Extract the cluster's dial-time-validated safe dialer
into a shared internal/netutil package (AssertHostAllowed /
AssertIPAllowed / SafeDialContext / NewSafeHTTPClient) so every
server-side fetcher shares one policy and cannot drift apart. Apply it
to the external-sub fetcher; refactor cluster to consume the shared
implementation (byte-identical behaviour). Redirect targets are
re-validated. DNS-rebinding TOCTOU remains closed (per-IP check at
dial time). Cloud metadata stays blocked even in lab mode.
Deps (H1, M2):
- github.com/golang-jwt/jwt/v5 v5.2.1 -> v5.2.2 (CVE-2025-30204,
unauthenticated DoS via crafted Authorization header on /login).
- github.com/quic-go/quic-go v0.59.0 -> v0.59.1 (CVE-2026-40898,
HTTP/3 QPACK memory-exhaustion DoS).
Tests: added netutil/ssrf_test.go and converter/external_links_test.go
(loopback blocked by default, allowed in lab mode, metadata always
blocked). go vet + gofmt clean; netutil/cluster/converter/auth/router
packages pass. Pre-existing mihomo/config schema-test failures are
unaffected and fail identically on main.
fix(security): centralize SSRF dial-time validation; patch jwt/quic-go CVEs
Addresses audit findings H1, M1, M2.
SSRF (M1): mergeExternalSubscriptionLinks fetched operator-supplied
external-subscription URLs with a plain http.Client — no SSRF protection,
unlike the cluster sync path. An admin could target cloud-metadata
endpoints (169.254.169.254) or probe the internal network from the
server's vantage. Extract the cluster's dial-time-validated safe dialer
into a shared internal/netutil package (AssertHostAllowed /
AssertIPAllowed / SafeDialContext / NewSafeHTTPClient) so every
server-side fetcher shares one policy and cannot drift apart. Apply it
to the external-sub fetcher; refactor cluster to consume the shared
implementation (byte-identical behaviour). Redirect targets are
re-validated. DNS-rebinding TOCTOU remains closed (per-IP check at
dial time). Cloud metadata stays blocked even in lab mode.
Deps (H1, M2):
- github.com/golang-jwt/jwt/v5 v5.2.1 -> v5.2.2 (CVE-2025-30204,
unauthenticated DoS via crafted Authorization header on /login).
- github.com/quic-go/quic-go v0.59.0 -> v0.59.1 (CVE-2026-40898,
HTTP/3 QPACK memory-exhaustion DoS).
Tests: added netutil/ssrf_test.go and converter/external_links_test.go
(loopback blocked by default, allowed in lab mode, metadata always
blocked). go vet + gofmt clean; netutil/cluster/converter/auth/router
packages pass. Pre-existing mihomo/config schema-test failures are
unaffected and fail identically on main.
fix(security): centralize SSRF dial-time validation; patch jwt/quic-go CVEs
Addresses audit findings H1, M1, M2.
SSRF (M1): mergeExternalSubscriptionLinks fetched operator-supplied
external-subscription URLs with a plain http.Client — no SSRF protection,
unlike the cluster sync path. An admin could target cloud-metadata
endpoints (169.254.169.254) or probe the internal network from the
server's vantage. Extract the cluster's dial-time-validated safe dialer
into a shared internal/netutil package (AssertHostAllowed /
AssertIPAllowed / SafeDialContext / NewSafeHTTPClient) so every
server-side fetcher shares one policy and cannot drift apart. Apply it
to the external-sub fetcher; refactor cluster to consume the shared
implementation (byte-identical behaviour). Redirect targets are
re-validated. DNS-rebinding TOCTOU remains closed (per-IP check at
dial time). Cloud metadata stays blocked even in lab mode.
Deps (H1, M2):
- github.com/golang-jwt/jwt/v5 v5.2.1 -> v5.2.2 (CVE-2025-30204,
unauthenticated DoS via crafted Authorization header on /login).
- github.com/quic-go/quic-go v0.59.0 -> v0.59.1 (CVE-2026-40898,
HTTP/3 QPACK memory-exhaustion DoS).
Tests: added netutil/ssrf_test.go and converter/external_links_test.go
(loopback blocked by default, allowed in lab mode, metadata always
blocked). go vet + gofmt clean; netutil/cluster/converter/auth/router
packages pass. Pre-existing mihomo/config schema-test failures are
unaffected and fail identically on main.
fix(security): centralize SSRF dial-time validation; patch jwt/quic-go CVEs
Addresses audit findings H1, M1, M2.
SSRF (M1): mergeExternalSubscriptionLinks fetched operator-supplied
external-subscription URLs with a plain http.Client — no SSRF protection,
unlike the cluster sync path. An admin could target cloud-metadata
endpoints (169.254.169.254) or probe the internal network from the
server's vantage. Extract the cluster's dial-time-validated safe dialer
into a shared internal/netutil package (AssertHostAllowed /
AssertIPAllowed / SafeDialContext / NewSafeHTTPClient) so every
server-side fetcher shares one policy and cannot drift apart. Apply it
to the external-sub fetcher; refactor cluster to consume the shared
implementation (byte-identical behaviour). Redirect targets are
re-validated. DNS-rebinding TOCTOU remains closed (per-IP check at
dial time). Cloud metadata stays blocked even in lab mode.
Deps (H1, M2):
- github.com/golang-jwt/jwt/v5 v5.2.1 -> v5.2.2 (CVE-2025-30204,
unauthenticated DoS via crafted Authorization header on /login).
- github.com/quic-go/quic-go v0.59.0 -> v0.59.1 (CVE-2026-40898,
HTTP/3 QPACK memory-exhaustion DoS).
Tests: added netutil/ssrf_test.go and converter/external_links_test.go
(loopback blocked by default, allowed in lab mode, metadata always
blocked). go vet + gofmt clean; netutil/cluster/converter/auth/router
packages pass. Pre-existing mihomo/config schema-test failures are
unaffected and fail identically on main.
fix(security): centralize SSRF dial-time validation; patch jwt/quic-go CVEs
Addresses audit findings H1, M1, M2.
SSRF (M1): mergeExternalSubscriptionLinks fetched operator-supplied
external-subscription URLs with a plain http.Client — no SSRF protection,
unlike the cluster sync path. An admin could target cloud-metadata
endpoints (169.254.169.254) or probe the internal network from the
server's vantage. Extract the cluster's dial-time-validated safe dialer
into a shared internal/netutil package (AssertHostAllowed /
AssertIPAllowed / SafeDialContext / NewSafeHTTPClient) so every
server-side fetcher shares one policy and cannot drift apart. Apply it
to the external-sub fetcher; refactor cluster to consume the shared
implementation (byte-identical behaviour). Redirect targets are
re-validated. DNS-rebinding TOCTOU remains closed (per-IP check at
dial time). Cloud metadata stays blocked even in lab mode.
Deps (H1, M2):
- github.com/golang-jwt/jwt/v5 v5.2.1 -> v5.2.2 (CVE-2025-30204,
unauthenticated DoS via crafted Authorization header on /login).
- github.com/quic-go/quic-go v0.59.0 -> v0.59.1 (CVE-2026-40898,
HTTP/3 QPACK memory-exhaustion DoS).
Tests: added netutil/ssrf_test.go and converter/external_links_test.go
(loopback blocked by default, allowed in lab mode, metadata always
blocked). go vet + gofmt clean; netutil/cluster/converter/auth/router
packages pass. Pre-existing mihomo/config schema-test failures are
unaffected and fail identically on main.
fix(security): centralize SSRF dial-time validation; patch jwt/quic-go CVEs
Addresses audit findings H1, M1, M2.
SSRF (M1): mergeExternalSubscriptionLinks fetched operator-supplied
external-subscription URLs with a plain http.Client — no SSRF protection,
unlike the cluster sync path. An admin could target cloud-metadata
endpoints (169.254.169.254) or probe the internal network from the
server's vantage. Extract the cluster's dial-time-validated safe dialer
into a shared internal/netutil package (AssertHostAllowed /
AssertIPAllowed / SafeDialContext / NewSafeHTTPClient) so every
server-side fetcher shares one policy and cannot drift apart. Apply it
to the external-sub fetcher; refactor cluster to consume the shared
implementation (byte-identical behaviour). Redirect targets are
re-validated. DNS-rebinding TOCTOU remains closed (per-IP check at
dial time). Cloud metadata stays blocked even in lab mode.
Deps (H1, M2):
- github.com/golang-jwt/jwt/v5 v5.2.1 -> v5.2.2 (CVE-2025-30204,
unauthenticated DoS via crafted Authorization header on /login).
- github.com/quic-go/quic-go v0.59.0 -> v0.59.1 (CVE-2026-40898,
HTTP/3 QPACK memory-exhaustion DoS).
Tests: added netutil/ssrf_test.go and converter/external_links_test.go
(loopback blocked by default, allowed in lab mode, metadata always
blocked). go vet + gofmt clean; netutil/cluster/converter/auth/router
packages pass. Pre-existing mihomo/config schema-test failures are
unaffected and fail identically on main.
fix(security): centralize SSRF dial-time validation; patch jwt/quic-go CVEs
Addresses audit findings H1, M1, M2.
SSRF (M1): mergeExternalSubscriptionLinks fetched operator-supplied
external-subscription URLs with a plain http.Client — no SSRF protection,
unlike the cluster sync path. An admin could target cloud-metadata
endpoints (169.254.169.254) or probe the internal network from the
server's vantage. Extract the cluster's dial-time-validated safe dialer
into a shared internal/netutil package (AssertHostAllowed /
AssertIPAllowed / SafeDialContext / NewSafeHTTPClient) so every
server-side fetcher shares one policy and cannot drift apart. Apply it
to the external-sub fetcher; refactor cluster to consume the shared
implementation (byte-identical behaviour). Redirect targets are
re-validated. DNS-rebinding TOCTOU remains closed (per-IP check at
dial time). Cloud metadata stays blocked even in lab mode.
Deps (H1, M2):
- github.com/golang-jwt/jwt/v5 v5.2.1 -> v5.2.2 (CVE-2025-30204,
unauthenticated DoS via crafted Authorization header on /login).
- github.com/quic-go/quic-go v0.59.0 -> v0.59.1 (CVE-2026-40898,
HTTP/3 QPACK memory-exhaustion DoS).
Tests: added netutil/ssrf_test.go and converter/external_links_test.go
(loopback blocked by default, allowed in lab mode, metadata always
blocked). go vet + gofmt clean; netutil/cluster/converter/auth/router
packages pass. Pre-existing mihomo/config schema-test failures are
unaffected and fail identically on main.
fix(security): centralize SSRF dial-time validation; patch jwt/quic-go CVEs
Addresses audit findings H1, M1, M2.
SSRF (M1): mergeExternalSubscriptionLinks fetched operator-supplied
external-subscription URLs with a plain http.Client — no SSRF protection,
unlike the cluster sync path. An admin could target cloud-metadata
endpoints (169.254.169.254) or probe the internal network from the
server's vantage. Extract the cluster's dial-time-validated safe dialer
into a shared internal/netutil package (AssertHostAllowed /
AssertIPAllowed / SafeDialContext / NewSafeHTTPClient) so every
server-side fetcher shares one policy and cannot drift apart. Apply it
to the external-sub fetcher; refactor cluster to consume the shared
implementation (byte-identical behaviour). Redirect targets are
re-validated. DNS-rebinding TOCTOU remains closed (per-IP check at
dial time). Cloud metadata stays blocked even in lab mode.
Deps (H1, M2):
- github.com/golang-jwt/jwt/v5 v5.2.1 -> v5.2.2 (CVE-2025-30204,
unauthenticated DoS via crafted Authorization header on /login).
- github.com/quic-go/quic-go v0.59.0 -> v0.59.1 (CVE-2026-40898,
HTTP/3 QPACK memory-exhaustion DoS).
Tests: added netutil/ssrf_test.go and converter/external_links_test.go
(loopback blocked by default, allowed in lab mode, metadata always
blocked). go vet + gofmt clean; netutil/cluster/converter/auth/router
packages pass. Pre-existing mihomo/config schema-test failures are
unaffected and fail identically on main.
fix(security): centralize SSRF dial-time validation; patch jwt/quic-go CVEs
Addresses audit findings H1, M1, M2.
SSRF (M1): mergeExternalSubscriptionLinks fetched operator-supplied
external-subscription URLs with a plain http.Client — no SSRF protection,
unlike the cluster sync path. An admin could target cloud-metadata
endpoints (169.254.169.254) or probe the internal network from the
server's vantage. Extract the cluster's dial-time-validated safe dialer
into a shared internal/netutil package (AssertHostAllowed /
AssertIPAllowed / SafeDialContext / NewSafeHTTPClient) so every
server-side fetcher shares one policy and cannot drift apart. Apply it
to the external-sub fetcher; refactor cluster to consume the shared
implementation (byte-identical behaviour). Redirect targets are
re-validated. DNS-rebinding TOCTOU remains closed (per-IP check at
dial time). Cloud metadata stays blocked even in lab mode.
Deps (H1, M2):
- github.com/golang-jwt/jwt/v5 v5.2.1 -> v5.2.2 (CVE-2025-30204,
unauthenticated DoS via crafted Authorization header on /login).
- github.com/quic-go/quic-go v0.59.0 -> v0.59.1 (CVE-2026-40898,
HTTP/3 QPACK memory-exhaustion DoS).
Tests: added netutil/ssrf_test.go and converter/external_links_test.go
(loopback blocked by default, allowed in lab mode, metadata always
blocked). go vet + gofmt clean; netutil/cluster/converter/auth/router
packages pass. Pre-existing mihomo/config schema-test failures are
unaffected and fail identically on main.
fix(security): centralize SSRF dial-time validation; patch jwt/quic-go CVEs
Addresses audit findings H1, M1, M2.
SSRF (M1): mergeExternalSubscriptionLinks fetched operator-supplied
external-subscription URLs with a plain http.Client — no SSRF protection,
unlike the cluster sync path. An admin could target cloud-metadata
endpoints (169.254.169.254) or probe the internal network from the
server's vantage. Extract the cluster's dial-time-validated safe dialer
into a shared internal/netutil package (AssertHostAllowed /
AssertIPAllowed / SafeDialContext / NewSafeHTTPClient) so every
server-side fetcher shares one policy and cannot drift apart. Apply it
to the external-sub fetcher; refactor cluster to consume the shared
implementation (byte-identical behaviour). Redirect targets are
re-validated. DNS-rebinding TOCTOU remains closed (per-IP check at
dial time). Cloud metadata stays blocked even in lab mode.
Deps (H1, M2):
- github.com/golang-jwt/jwt/v5 v5.2.1 -> v5.2.2 (CVE-2025-30204,
unauthenticated DoS via crafted Authorization header on /login).
- github.com/quic-go/quic-go v0.59.0 -> v0.59.1 (CVE-2026-40898,
HTTP/3 QPACK memory-exhaustion DoS).
Tests: added netutil/ssrf_test.go and converter/external_links_test.go
(loopback blocked by default, allowed in lab mode, metadata always
blocked). go vet + gofmt clean; netutil/cluster/converter/auth/router
packages pass. Pre-existing mihomo/config schema-test failures are
unaffected and fail identically on main.
fix(security): centralize SSRF dial-time validation; patch jwt/quic-go CVEs
Addresses audit findings H1, M1, M2.
SSRF (M1): mergeExternalSubscriptionLinks fetched operator-supplied
external-subscription URLs with a plain http.Client — no SSRF protection,
unlike the cluster sync path. An admin could target cloud-metadata
endpoints (169.254.169.254) or probe the internal network from the
server's vantage. Extract the cluster's dial-time-validated safe dialer
into a shared internal/netutil package (AssertHostAllowed /
AssertIPAllowed / SafeDialContext / NewSafeHTTPClient) so every
server-side fetcher shares one policy and cannot drift apart. Apply it
to the external-sub fetcher; refactor cluster to consume the shared
implementation (byte-identical behaviour). Redirect targets are
re-validated. DNS-rebinding TOCTOU remains closed (per-IP check at
dial time). Cloud metadata stays blocked even in lab mode.
Deps (H1, M2):
- github.com/golang-jwt/jwt/v5 v5.2.1 -> v5.2.2 (CVE-2025-30204,
unauthenticated DoS via crafted Authorization header on /login).
- github.com/quic-go/quic-go v0.59.0 -> v0.59.1 (CVE-2026-40898,
HTTP/3 QPACK memory-exhaustion DoS).
Tests: added netutil/ssrf_test.go and converter/external_links_test.go
(loopback blocked by default, allowed in lab mode, metadata always
blocked). go vet + gofmt clean; netutil/cluster/converter/auth/router
packages pass. Pre-existing mihomo/config schema-test failures are
unaffected and fail identically on main.
fix(security): centralize SSRF dial-time validation; patch jwt/quic-go CVEs
Addresses audit findings H1, M1, M2.
SSRF (M1): mergeExternalSubscriptionLinks fetched operator-supplied
external-subscription URLs with a plain http.Client — no SSRF protection,
unlike the cluster sync path. An admin could target cloud-metadata
endpoints (169.254.169.254) or probe the internal network from the
server's vantage. Extract the cluster's dial-time-validated safe dialer
into a shared internal/netutil package (AssertHostAllowed /
AssertIPAllowed / SafeDialContext / NewSafeHTTPClient) so every
server-side fetcher shares one policy and cannot drift apart. Apply it
to the external-sub fetcher; refactor cluster to consume the shared
implementation (byte-identical behaviour). Redirect targets are
re-validated. DNS-rebinding TOCTOU remains closed (per-IP check at
dial time). Cloud metadata stays blocked even in lab mode.
Deps (H1, M2):
- github.com/golang-jwt/jwt/v5 v5.2.1 -> v5.2.2 (CVE-2025-30204,
unauthenticated DoS via crafted Authorization header on /login).
- github.com/quic-go/quic-go v0.59.0 -> v0.59.1 (CVE-2026-40898,
HTTP/3 QPACK memory-exhaustion DoS).
Tests: added netutil/ssrf_test.go and converter/external_links_test.go
(loopback blocked by default, allowed in lab mode, metadata always
blocked). go vet + gofmt clean; netutil/cluster/converter/auth/router
packages pass. Pre-existing mihomo/config schema-test failures are
unaffected and fail identically on main.
codebuddy
c8c9dcb98e