Buriburizaemon/nezha_domains
1
0
Fork 0
mirror of https://github.com/Buriburizaem0n/nezha_domains.git synced 2026-09-19 17:50:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): restrict service monitors to probe tasks

Browse Source
This commit is contained in:
naiba
2026-08-15 05:00:28 +00:00
parent 42d9e4c8c3
commit 38824dbc11
16 changed files with 338 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/dashboard/controller/oauth2.go
+5 -2
View File
@@ -26,8 +26,11 @@ import (
// code to their own origin and bind the victim's identity. A request Host is
// trusted only when it is an operator-declared dashboard host (the same
// allowlist that guards NAT routing). Otherwise the redirect is pinned to the
// operator-declared DashboardHost; when DashboardHost is empty the operator has
// not pinned a dashboard origin, so the request Host is passed through.
// operator-declared DashboardHost. Empty DashboardHost intentionally retains
// dynamic/multi-domain deployments by passing through request Host; those
// deployments must validate Host at their trusted proxy and register exact
// redirect URIs at the OAuth provider. GHSA-rf68-8gjr-36q7 documents this
// configuration boundary and must be updated if this compatibility changes.
func getRedirectURL(c *gin.Context) string {
scheme := "http://"
referer := c.Request.Referer()