- H-3: subpage loadTemplate accepted arbitrary theme_dir, reachable
from the unauthenticated /api/v1/client/sub/:token?html=1 endpoint.
Add sanitizeThemeDir() restricting to /var/lib/3m-ui/themes,
/etc/3m-ui/themes, /usr/local/share/3m-ui/themes. Validated on both
load and save.
- M-1: Mihomo external-controller shipped with an empty secret. Even
bound to loopback, any co-located unprivileged process could drive
the REST API. Generate a process-scoped random secret via crypto/rand
(ControllerSecret()); traffic collector already reads it from the
generated config.
- H-4: ACMECommand / WARPTemplate / ReverseProxyTemplate used
fmt.Sprintf with unescaped user input (shell / YAML / nginx injection
if admin account is hijacked). Add isValidDomain() and shellQuote().
ACMECommand and WARPTemplate now return (string, error). WARP uses
yaml.Marshal for structured output. api.go handlers updated.
- LOW-12: ACME cert_file/key_file paths now restricted to an allowlist
(/etc/ssl/, /etc/letsencrypt/, /etc/3m-ui/, /var/lib/3m-ui/, etc.).
fix(backend): path traversal, mihomo secret, template injection, acme path
- H-3: subpage loadTemplate accepted arbitrary theme_dir, reachable
from the unauthenticated /api/v1/client/sub/:token?html=1 endpoint.
Add sanitizeThemeDir() restricting to /var/lib/3m-ui/themes,
/etc/3m-ui/themes, /usr/local/share/3m-ui/themes. Validated on both
load and save.
- M-1: Mihomo external-controller shipped with an empty secret. Even
bound to loopback, any co-located unprivileged process could drive
the REST API. Generate a process-scoped random secret via crypto/rand
(ControllerSecret()); traffic collector already reads it from the
generated config.
- H-4: ACMECommand / WARPTemplate / ReverseProxyTemplate used
fmt.Sprintf with unescaped user input (shell / YAML / nginx injection
if admin account is hijacked). Add isValidDomain() and shellQuote().
ACMECommand and WARPTemplate now return (string, error). WARP uses
yaml.Marshal for structured output. api.go handlers updated.
- LOW-12: ACME cert_file/key_file paths now restricted to an allowlist
(/etc/ssl/, /etc/letsencrypt/, /etc/3m-ui/, /var/lib/3m-ui/, etc.).
fix(backend): path traversal, mihomo secret, template injection, acme path
- H-3: subpage loadTemplate accepted arbitrary theme_dir, reachable
from the unauthenticated /api/v1/client/sub/:token?html=1 endpoint.
Add sanitizeThemeDir() restricting to /var/lib/3m-ui/themes,
/etc/3m-ui/themes, /usr/local/share/3m-ui/themes. Validated on both
load and save.
- M-1: Mihomo external-controller shipped with an empty secret. Even
bound to loopback, any co-located unprivileged process could drive
the REST API. Generate a process-scoped random secret via crypto/rand
(ControllerSecret()); traffic collector already reads it from the
generated config.
- H-4: ACMECommand / WARPTemplate / ReverseProxyTemplate used
fmt.Sprintf with unescaped user input (shell / YAML / nginx injection
if admin account is hijacked). Add isValidDomain() and shellQuote().
ACMECommand and WARPTemplate now return (string, error). WARP uses
yaml.Marshal for structured output. api.go handlers updated.
- LOW-12: ACME cert_file/key_file paths now restricted to an allowlist
(/etc/ssl/, /etc/letsencrypt/, /etc/3m-ui/, /var/lib/3m-ui/, etc.).
fix(backend): path traversal, mihomo secret, template injection, acme path
- H-3: subpage loadTemplate accepted arbitrary theme_dir, reachable
from the unauthenticated /api/v1/client/sub/:token?html=1 endpoint.
Add sanitizeThemeDir() restricting to /var/lib/3m-ui/themes,
/etc/3m-ui/themes, /usr/local/share/3m-ui/themes. Validated on both
load and save.
- M-1: Mihomo external-controller shipped with an empty secret. Even
bound to loopback, any co-located unprivileged process could drive
the REST API. Generate a process-scoped random secret via crypto/rand
(ControllerSecret()); traffic collector already reads it from the
generated config.
- H-4: ACMECommand / WARPTemplate / ReverseProxyTemplate used
fmt.Sprintf with unescaped user input (shell / YAML / nginx injection
if admin account is hijacked). Add isValidDomain() and shellQuote().
ACMECommand and WARPTemplate now return (string, error). WARP uses
yaml.Marshal for structured output. api.go handlers updated.
- LOW-12: ACME cert_file/key_file paths now restricted to an allowlist
(/etc/ssl/, /etc/letsencrypt/, /etc/3m-ui/, /var/lib/3m-ui/, etc.).
fix(backend): path traversal, mihomo secret, template injection, acme path
- H-3: subpage loadTemplate accepted arbitrary theme_dir, reachable
from the unauthenticated /api/v1/client/sub/:token?html=1 endpoint.
Add sanitizeThemeDir() restricting to /var/lib/3m-ui/themes,
/etc/3m-ui/themes, /usr/local/share/3m-ui/themes. Validated on both
load and save.
- M-1: Mihomo external-controller shipped with an empty secret. Even
bound to loopback, any co-located unprivileged process could drive
the REST API. Generate a process-scoped random secret via crypto/rand
(ControllerSecret()); traffic collector already reads it from the
generated config.
- H-4: ACMECommand / WARPTemplate / ReverseProxyTemplate used
fmt.Sprintf with unescaped user input (shell / YAML / nginx injection
if admin account is hijacked). Add isValidDomain() and shellQuote().
ACMECommand and WARPTemplate now return (string, error). WARP uses
yaml.Marshal for structured output. api.go handlers updated.
- LOW-12: ACME cert_file/key_file paths now restricted to an allowlist
(/etc/ssl/, /etc/letsencrypt/, /etc/3m-ui/, /var/lib/3m-ui/, etc.).
fix(backend): path traversal, mihomo secret, template injection, acme path
- H-3: subpage loadTemplate accepted arbitrary theme_dir, reachable
from the unauthenticated /api/v1/client/sub/:token?html=1 endpoint.
Add sanitizeThemeDir() restricting to /var/lib/3m-ui/themes,
/etc/3m-ui/themes, /usr/local/share/3m-ui/themes. Validated on both
load and save.
- M-1: Mihomo external-controller shipped with an empty secret. Even
bound to loopback, any co-located unprivileged process could drive
the REST API. Generate a process-scoped random secret via crypto/rand
(ControllerSecret()); traffic collector already reads it from the
generated config.
- H-4: ACMECommand / WARPTemplate / ReverseProxyTemplate used
fmt.Sprintf with unescaped user input (shell / YAML / nginx injection
if admin account is hijacked). Add isValidDomain() and shellQuote().
ACMECommand and WARPTemplate now return (string, error). WARP uses
yaml.Marshal for structured output. api.go handlers updated.
- LOW-12: ACME cert_file/key_file paths now restricted to an allowlist
(/etc/ssl/, /etc/letsencrypt/, /etc/3m-ui/, /var/lib/3m-ui/, etc.).
fix(backend): path traversal, mihomo secret, template injection, acme path
- H-3: subpage loadTemplate accepted arbitrary theme_dir, reachable
from the unauthenticated /api/v1/client/sub/:token?html=1 endpoint.
Add sanitizeThemeDir() restricting to /var/lib/3m-ui/themes,
/etc/3m-ui/themes, /usr/local/share/3m-ui/themes. Validated on both
load and save.
- M-1: Mihomo external-controller shipped with an empty secret. Even
bound to loopback, any co-located unprivileged process could drive
the REST API. Generate a process-scoped random secret via crypto/rand
(ControllerSecret()); traffic collector already reads it from the
generated config.
- H-4: ACMECommand / WARPTemplate / ReverseProxyTemplate used
fmt.Sprintf with unescaped user input (shell / YAML / nginx injection
if admin account is hijacked). Add isValidDomain() and shellQuote().
ACMECommand and WARPTemplate now return (string, error). WARP uses
yaml.Marshal for structured output. api.go handlers updated.
- LOW-12: ACME cert_file/key_file paths now restricted to an allowlist
(/etc/ssl/, /etc/letsencrypt/, /etc/3m-ui/, /var/lib/3m-ui/, etc.).
fix(backend): path traversal, mihomo secret, template injection, acme path
- H-3: subpage loadTemplate accepted arbitrary theme_dir, reachable
from the unauthenticated /api/v1/client/sub/:token?html=1 endpoint.
Add sanitizeThemeDir() restricting to /var/lib/3m-ui/themes,
/etc/3m-ui/themes, /usr/local/share/3m-ui/themes. Validated on both
load and save.
- M-1: Mihomo external-controller shipped with an empty secret. Even
bound to loopback, any co-located unprivileged process could drive
the REST API. Generate a process-scoped random secret via crypto/rand
(ControllerSecret()); traffic collector already reads it from the
generated config.
- H-4: ACMECommand / WARPTemplate / ReverseProxyTemplate used
fmt.Sprintf with unescaped user input (shell / YAML / nginx injection
if admin account is hijacked). Add isValidDomain() and shellQuote().
ACMECommand and WARPTemplate now return (string, error). WARP uses
yaml.Marshal for structured output. api.go handlers updated.
- LOW-12: ACME cert_file/key_file paths now restricted to an allowlist
(/etc/ssl/, /etc/letsencrypt/, /etc/3m-ui/, /var/lib/3m-ui/, etc.).
fix(backend): path traversal, mihomo secret, template injection, acme path
- H-3: subpage loadTemplate accepted arbitrary theme_dir, reachable
from the unauthenticated /api/v1/client/sub/:token?html=1 endpoint.
Add sanitizeThemeDir() restricting to /var/lib/3m-ui/themes,
/etc/3m-ui/themes, /usr/local/share/3m-ui/themes. Validated on both
load and save.
- M-1: Mihomo external-controller shipped with an empty secret. Even
bound to loopback, any co-located unprivileged process could drive
the REST API. Generate a process-scoped random secret via crypto/rand
(ControllerSecret()); traffic collector already reads it from the
generated config.
- H-4: ACMECommand / WARPTemplate / ReverseProxyTemplate used
fmt.Sprintf with unescaped user input (shell / YAML / nginx injection
if admin account is hijacked). Add isValidDomain() and shellQuote().
ACMECommand and WARPTemplate now return (string, error). WARP uses
yaml.Marshal for structured output. api.go handlers updated.
- LOW-12: ACME cert_file/key_file paths now restricted to an allowlist
(/etc/ssl/, /etc/letsencrypt/, /etc/3m-ui/, /var/lib/3m-ui/, etc.).
fix(backend): path traversal, mihomo secret, template injection, acme path
- H-3: subpage loadTemplate accepted arbitrary theme_dir, reachable
from the unauthenticated /api/v1/client/sub/:token?html=1 endpoint.
Add sanitizeThemeDir() restricting to /var/lib/3m-ui/themes,
/etc/3m-ui/themes, /usr/local/share/3m-ui/themes. Validated on both
load and save.
- M-1: Mihomo external-controller shipped with an empty secret. Even
bound to loopback, any co-located unprivileged process could drive
the REST API. Generate a process-scoped random secret via crypto/rand
(ControllerSecret()); traffic collector already reads it from the
generated config.
- H-4: ACMECommand / WARPTemplate / ReverseProxyTemplate used
fmt.Sprintf with unescaped user input (shell / YAML / nginx injection
if admin account is hijacked). Add isValidDomain() and shellQuote().
ACMECommand and WARPTemplate now return (string, error). WARP uses
yaml.Marshal for structured output. api.go handlers updated.
- LOW-12: ACME cert_file/key_file paths now restricted to an allowlist
(/etc/ssl/, /etc/letsencrypt/, /etc/3m-ui/, /var/lib/3m-ui/, etc.).
fix(backend): path traversal, mihomo secret, template injection, acme path
- H-3: subpage loadTemplate accepted arbitrary theme_dir, reachable
from the unauthenticated /api/v1/client/sub/:token?html=1 endpoint.
Add sanitizeThemeDir() restricting to /var/lib/3m-ui/themes,
/etc/3m-ui/themes, /usr/local/share/3m-ui/themes. Validated on both
load and save.
- M-1: Mihomo external-controller shipped with an empty secret. Even
bound to loopback, any co-located unprivileged process could drive
the REST API. Generate a process-scoped random secret via crypto/rand
(ControllerSecret()); traffic collector already reads it from the
generated config.
- H-4: ACMECommand / WARPTemplate / ReverseProxyTemplate used
fmt.Sprintf with unescaped user input (shell / YAML / nginx injection
if admin account is hijacked). Add isValidDomain() and shellQuote().
ACMECommand and WARPTemplate now return (string, error). WARP uses
yaml.Marshal for structured output. api.go handlers updated.
- LOW-12: ACME cert_file/key_file paths now restricted to an allowlist
(/etc/ssl/, /etc/letsencrypt/, /etc/3m-ui/, /var/lib/3m-ui/, etc.).
fix(backend): path traversal, mihomo secret, template injection, acme path
- H-3: subpage loadTemplate accepted arbitrary theme_dir, reachable
from the unauthenticated /api/v1/client/sub/:token?html=1 endpoint.
Add sanitizeThemeDir() restricting to /var/lib/3m-ui/themes,
/etc/3m-ui/themes, /usr/local/share/3m-ui/themes. Validated on both
load and save.
- M-1: Mihomo external-controller shipped with an empty secret. Even
bound to loopback, any co-located unprivileged process could drive
the REST API. Generate a process-scoped random secret via crypto/rand
(ControllerSecret()); traffic collector already reads it from the
generated config.
- H-4: ACMECommand / WARPTemplate / ReverseProxyTemplate used
fmt.Sprintf with unescaped user input (shell / YAML / nginx injection
if admin account is hijacked). Add isValidDomain() and shellQuote().
ACMECommand and WARPTemplate now return (string, error). WARP uses
yaml.Marshal for structured output. api.go handlers updated.
- LOW-12: ACME cert_file/key_file paths now restricted to an allowlist
(/etc/ssl/, /etc/letsencrypt/, /etc/3m-ui/, /var/lib/3m-ui/, etc.).
風雪
c852f0266a