Buriburizaemon/nezha_domains
1
0
Fork 0
mirror of https://github.com/Buriburizaem0n/nezha_domains.git synced 2026-09-21 10:40:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): restrict service monitors to probe tasks

Browse Source
This commit is contained in:
naiba
2026-08-15 05:00:28 +00:00
parent 42d9e4c8c3
commit 38824dbc11
16 changed files with 338 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/dashboard/rpc/service_dispatch.go
+13 -2
View File
@@ -14,6 +14,17 @@ func DispatchTask(serviceSentinelDispatchBus <-chan *model.Service) {
if task == nil {
continue
}
if err := model.ValidateServiceMonitorType(uint64(task.Type)); err != nil {
// Defense in depth for stale database rows and future internal callers:
// Service.Type shares its integer namespace with command/config tasks.
log.Printf("NEZHA>> DispatchTask rejected service %d: %v", task.ID, err)
continue
}
probe := task.PB()
if probe == nil {
log.Printf("NEZHA>> DispatchTask rejected service %d: invalid probe", task.ID)
continue
}
switch task.Cover {
case model.ServiceCoverIgnoreAll:
@@ -29,7 +40,7 @@ func DispatchTask(serviceSentinelDispatchBus <-chan *model.Service) {
if !canSendTaskToServer(task, server) {
continue
}
if err := server.SendTask(task.PB()); err != nil && !errors.Is(err, model.ErrTaskStreamOffline) {
if err := server.SendTask(probe); err != nil && !errors.Is(err, model.ErrTaskStreamOffline) {
log.Printf("NEZHA>> DispatchTask send error (server=%d): %v", id, err)
}
}
@@ -41,7 +52,7 @@ func DispatchTask(serviceSentinelDispatchBus <-chan *model.Service) {
if !canSendTaskToServer(task, server) {
continue
}
if err := server.SendTask(task.PB()); err != nil && !errors.Is(err, model.ErrTaskStreamOffline) {
if err := server.SendTask(probe); err != nil && !errors.Is(err, model.ErrTaskStreamOffline) {
log.Printf("NEZHA>> DispatchTask send error (server=%d): %v", id, err)
}
}