fix(security): harden server and service deletion lifecycle (#1220)

* test: TDD regression tests for GHSA-jx78-55p5-rwv5 stream quota enforcement

* Apply remaining changes

* fix: update action SHA allowlist and test assertions to match dependabot bump

* fix: close GHSA-jx78-55p5-rwv5 incomplete fix of GHSA-qjpp-gffx-2wm9

Finding 1 (Moderate): nil-guard reporterServer in delayCheck and notifyCheck.
ServerShared has its own lock independent of serviceResponseDataStoreLock, so
m := ServerShared.GetList() taken inside the worker can return a nil entry for
the reporter if the server was concurrently deleted. Previously this caused an
unrecovered SIGSEGV in the worker goroutine (and in the gRPC layer with no
recovery interceptor), taking down the whole instance.

Finding 2 (Low): nil-guard ss.services[id] in ServiceSentinel.Delete().
A caller-supplied id that is absent from the registry caused
ss.services[id].CronJobID to panic, aborting the Delete loop and leaving every
subsequent valid id as a zombie service (DB row deleted, in-memory entry kept,
cron probe still running).

Regression tests added for both findings following the existing
servicesentinel_lifecycle_test.go patterns.

* Apply remaining changes

* chore: replace commit hashes with version tags in test.yml

* fix(server): serialize authoritative lifecycle changes

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

* fix(service): bind reports to reporter lifecycle

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

* fix(rpc): reject results from stale task streams

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

* fix(agentcompat): allow version-tagged actions

* fix(agentcompat): allow literal checkout refs

* refactor(agentcompat): remove SHA resolver policy

* test(agentcompat): remove resolver SHA fixtures

* test(agentcompat): remove mutable ref fixtures

* test(agentcompat): use tagged actions in secure fixtures

* test(agentcompat): update credential fixtures for tags

* test(agentcompat): update reusable action fixtures

* test(agentcompat): update artifact redaction fixtures

* test(agentcompat): finish artifact fixture tag migration

* test(agentcompat): update workflow validation fixtures

* test(agentcompat): update dependency workflow fixture

* ci(agentcompat): stop pinning cross-repository revisions

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: naiba <hi@nai.ba>
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

service/singleton/server.go

@@ -6,6 +6,7 @@ import (
 	"log"
 	"slices"
 	"strings"
+	"sync"
 
 	"github.com/nezhahq/nezha/model"
 	"github.com/nezhahq/nezha/pkg/ddns"
@@ -15,6 +16,10 @@ import (
 type ServerClass struct {
 	class[uint64, *model.Server]
 
+	// lifecycleMu serializes changes to the authoritative server entries with
+	// synchronous ServiceSentinel report processing.
+	lifecycleMu sync.RWMutex
+
 	uuidToID map[string]uint64
 
 	sortedListForGuest []*model.Server
@@ -71,7 +76,26 @@ func ownerIsAdmin(ownerUID uint64) bool {
 	return userIsAdmin(ownerUID)
 }
 
+func (c *ServerClass) lockLifecycleRead() {
+	c.lifecycleMu.RLock()
+}
+
+func (c *ServerClass) unlockLifecycleRead() {
+	c.lifecycleMu.RUnlock()
+}
+
+func (c *ServerClass) lockLifecycleWrite() {
+	c.lifecycleMu.Lock()
+}
+
+func (c *ServerClass) unlockLifecycleWrite() {
+	c.lifecycleMu.Unlock()
+}
+
 func (c *ServerClass) Update(s *model.Server, uuid string) {
+	c.lockLifecycleWrite()
+	defer c.unlockLifecycleWrite()
+
 	c.listMu.Lock()
 
 	c.list[s.ID] = s
@@ -91,6 +115,9 @@ func (c *ServerClass) Update(s *model.Server, uuid string) {
 }
 
 func (c *ServerClass) Delete(idList []uint64) {
+	c.lockLifecycleWrite()
+	defer c.unlockLifecycleWrite()
+
 	c.listMu.Lock()
 
 	for _, id := range idList {
@@ -107,6 +134,17 @@ func (c *ServerClass) Delete(idList []uint64) {
 	c.sortList()
 }
 
+// setUserID updates in-memory ownership under the server lifecycle lock so a
+// transfer cannot change authorization during synchronous report processing.
+func (c *ServerClass) setUserID(id, userID uint64) {
+	c.lockLifecycleWrite()
+	defer c.unlockLifecycleWrite()
+
+	if s, ok := c.Get(id); ok && s != nil {
+		s.SetUserID(userID)
+	}
+}
+
 func (c *ServerClass) GetSortedListForGuest() []*model.Server {
 	c.sortedListMu.RLock()
 	defer c.sortedListMu.RUnlock()

service/singleton/server_transfer.go

@@ -663,11 +663,9 @@ func (c *ServerTransferClass) Initiate(tx *gorm.DB, serverID, fromUserID, toUser
 // and admits the old AgentSecret on the happy "owner match" path —
 // bypassing the bounded pending-tolerance contract.
 func (c *ServerTransferClass) Register(t *model.ServerTransfer) {
-	if s, ok := ServerShared.Get(t.ServerID); ok && s != nil {
-		// SetUserID over atomic write — auth.go hot path concurrently
-		// reads this field; a plain assignment would be a data race.
-		s.SetUserID(t.ToUserID)
-	}
+	// SetUserID uses an atomic write because auth.go reads this hot-path field
+	// concurrently; ServerClass also serializes it with service reports.
+	ServerShared.setUserID(t.ServerID, t.ToUserID)
 
 	c.mu.Lock()
 	c.pending[t.ServerID] = t
@@ -1163,9 +1161,7 @@ func (c *ServerTransferClass) revertTransition(transferID uint64, newStatus mode
 	// no longer admits the destination user's global AgentSecret via
 	// ServerShared.GetUserID() == userId on the happy "owner match" path.
 	if transitionedByThisCall {
-		if s, ok := ServerShared.Get(t.ServerID); ok && s != nil {
-			s.SetUserID(t.FromUserID)
-		}
+		ServerShared.setUserID(t.ServerID, t.FromUserID)
 	}
 
 	// Self-heal: any non-Pending DB status invalidates the in-memory entry —

service/singleton/servicesentinel.go

@@ -394,7 +394,16 @@ func (ss *ServiceSentinel) Delete(ids []uint64) {
 		delete(ss.serviceStatusToday, id)
 
 		// 停掉定时任务
-		CronShared.Remove(ss.services[id].CronJobID)
+		// GHSA-jx78-55p5-rwv5 (Finding 2): guard against a caller supplying an id
+		// that does not exist in the in-memory registry.  CheckPermission returns
+		// vacuously true for unknown ids, so the controller layer cannot prevent
+		// this.  Without the guard, ss.services[id] is nil and the .CronJobID
+		// field access panics, aborting the Delete loop before the remaining valid
+		// ids are cleaned from memory — their service records were already deleted
+		// from the database, producing zombie services.
+		if svc := ss.services[id]; svc != nil {
+			CronShared.Remove(svc.CronJobID)
+		}
 		delete(ss.services, id)
 
 		delete(ss.monthlyStatus, id)
@@ -536,238 +545,252 @@ func (ss *ServiceSentinel) Close() {
 func (ss *ServiceSentinel) worker() {
 	// 从服务状态汇报管道获取汇报的服务数据
 	for r := range ss.serviceReportChannel {
-		cs, _ := ss.Get(r.Data.GetId())
-		reporter, _ := ServerShared.Get(r.Reporter)
-		// 入站结果必须匹配出站任务派发边界，避免 agent 伪造其他服务 ID 写入监控状态。
-		if !canReportServiceResult(cs, reporter, r.Data.GetType()) {
-			log.Printf("NEZHA>> Incorrect service monitor report %+v", r)
-			continue
-		}
-		if ss.serviceReportValidatedHook != nil {
-			ss.serviceReportValidatedHook(r.Data.GetId())
-		}
-
-		mh := r.Data
-		// Serialize Delete and Update before this accepted report causes any side effect.
-		ss.serviceResponseDataStoreLock.Lock()
-		serviceStatusToday := ss.serviceStatusToday[mh.GetId()]
-		serviceCurrentStatusData := ss.serviceCurrentStatusData[mh.GetId()]
-		currentService, serviceExists := ss.Get(mh.GetId())
-		if serviceStatusToday == nil || serviceCurrentStatusData == nil || !serviceExists ||
-			!canReportServiceResult(currentService, reporter, mh.GetType()) {
-			ss.serviceResponseDataStoreLock.Unlock()
-			continue
-		}
-		cs = currentService
-
-		if mh.Type == model.TaskTypeTCPPing || mh.Type == model.TaskTypeICMPPing {
-			// TCP/ICMP Ping 使用平均值计算后再写入
-			serviceTcpMap, ok := ss.serviceResponsePing[mh.GetId()]
-			if !ok {
-				serviceTcpMap = make(map[uint64]*pingStore)
-				ss.serviceResponsePing[mh.GetId()] = serviceTcpMap
-			}
-			ts, ok := serviceTcpMap[r.Reporter]
-			if !ok {
-				ts = &pingStore{}
-			}
-			ts.count++
-			ts.ping = (ts.ping*float64(ts.count-1) + float64(mh.Delay)) / float64(ts.count)
-			if mh.Successful {
-				ts.successCount++
-			}
-			if ts.count == Conf.AvgPingCount {
-				if TSDBEnabled() {
-					if err := TSDBShared.WriteServiceMetrics(&tsdb.ServiceMetrics{
-						ServiceID:  mh.GetId(),
-						ServerID:   r.Reporter,
-						Timestamp:  time.Now(),
-						Delay:      ts.ping,
-						Successful: ts.successCount*2 >= ts.count,
-					}); err != nil {
-						log.Printf("NEZHA>> Failed to save service monitor metrics to TSDB: %v", err)
-					}
-				} else {
-					if err := DB.Create(&model.ServiceHistory{
-						ServiceID: mh.GetId(),
-						AvgDelay:  ts.ping,
-						Data:      mh.Data,
-						ServerID:  r.Reporter,
-					}).Error; err != nil {
-						log.Printf("NEZHA>> Failed to save service monitor metrics: %v", err)
-					}
+		serverShared := ServerShared
+		func() {
+			defer func() {
+				if recovered := recover(); recovered != nil {
+					log.Printf("NEZHA>> Service monitor report processing panicked: %v", recovered)
 				}
-				ts.count = 0
-				ts.ping = 0
-				ts.successCount = 0
-			}
-			serviceTcpMap[r.Reporter] = ts
-		} else {
+			}()
+			ss.processReport(r, serverShared)
+		}()
+	}
+}
+
+func (ss *ServiceSentinel) processReport(r ReportData, serverShared *ServerClass) {
+	serverShared.lockLifecycleRead()
+	defer serverShared.unlockLifecycleRead()
+
+	cs, _ := ss.Get(r.Data.GetId())
+	reporter, _ := serverShared.Get(r.Reporter)
+	// 入站结果必须匹配出站任务派发边界，避免 agent 伪造其他服务 ID 写入监控状态。
+	if !canReportServiceResult(cs, reporter, r.Data.GetType()) {
+		log.Printf("NEZHA>> Incorrect service monitor report %+v", r)
+		return
+	}
+	if ss.serviceReportValidatedHook != nil {
+		ss.serviceReportValidatedHook(r.Data.GetId())
+	}
+
+	mh := r.Data
+	m := serverShared.GetList()
+	// Serialize Delete and Update before this accepted report causes any side effect.
+	ss.serviceResponseDataStoreLock.Lock()
+	defer ss.serviceResponseDataStoreLock.Unlock()
+	serviceStatusToday := ss.serviceStatusToday[mh.GetId()]
+	serviceCurrentStatusData := ss.serviceCurrentStatusData[mh.GetId()]
+	currentService, serviceExists := ss.Get(mh.GetId())
+	if serviceStatusToday == nil || serviceCurrentStatusData == nil || !serviceExists ||
+		!canReportServiceResult(currentService, reporter, mh.GetType()) {
+		return
+	}
+	cs = currentService
+
+	if mh.Type == model.TaskTypeTCPPing || mh.Type == model.TaskTypeICMPPing {
+		// TCP/ICMP Ping 使用平均值计算后再写入
+		serviceTcpMap, ok := ss.serviceResponsePing[mh.GetId()]
+		if !ok {
+			serviceTcpMap = make(map[uint64]*pingStore)
+			ss.serviceResponsePing[mh.GetId()] = serviceTcpMap
+		}
+		ts, ok := serviceTcpMap[r.Reporter]
+		if !ok {
+			ts = &pingStore{}
+		}
+		ts.count++
+		ts.ping = (ts.ping*float64(ts.count-1) + float64(mh.Delay)) / float64(ts.count)
+		if mh.Successful {
+			ts.successCount++
+		}
+		if ts.count == Conf.AvgPingCount {
 			if TSDBEnabled() {
 				if err := TSDBShared.WriteServiceMetrics(&tsdb.ServiceMetrics{
 					ServiceID:  mh.GetId(),
 					ServerID:   r.Reporter,
 					Timestamp:  time.Now(),
-					Delay:      float64(mh.Delay),
-					Successful: mh.Successful,
+					Delay:      ts.ping,
+					Successful: ts.successCount*2 >= ts.count,
 				}); err != nil {
 					log.Printf("NEZHA>> Failed to save service monitor metrics to TSDB: %v", err)
 				}
-			}
-		}
-
-		// 写入当天状态
-		if mh.Successful {
-			serviceStatusToday.Delay = (serviceStatusToday.Delay*float64(serviceStatusToday.Up) +
-				float64(mh.Delay)) / float64(serviceStatusToday.Up+1)
-			serviceStatusToday.Up++
-		} else {
-			serviceStatusToday.Down++
-		}
-
-		currentTime := time.Now()
-		if serviceCurrentStatusData.t.IsZero() {
-			serviceCurrentStatusData.t = currentTime
-		}
-
-		// 写入当前数据
-		if serviceCurrentStatusData.t.Before(currentTime) {
-			serviceCurrentStatusData.t = currentTime.Add(30 * time.Second)
-			serviceCurrentStatusData.result = append(serviceCurrentStatusData.result, mh)
-		}
-
-		// 更新当前状态
-		ss.serviceResponseDataStore[mh.GetId()] = serviceResponseData{}
-
-		// 永远是最新的 30 个数据的状态 [01:00, 02:00, 03:00] -> [04:00, 02:00, 03: 00]
-		for _, cs := range serviceCurrentStatusData.result {
-			if cs.GetId() > 0 {
-				rd := ss.serviceResponseDataStore[mh.GetId()]
-				if cs.Successful {
-					rd.Up++
-					rd.Delay = (rd.Delay*float64(rd.Up-1) + float64(cs.Delay)) / float64(rd.Up)
-				} else {
-					rd.Down++
-				}
-				ss.serviceResponseDataStore[mh.GetId()] = rd
-			}
-		}
-
-		// 计算在线率，
-		var stateCode uint8
-		{
-			upPercent := uint64(0)
-			rd := ss.serviceResponseDataStore[mh.GetId()]
-			if rd.Down+rd.Up > 0 {
-				upPercent = rd.Up * 100 / (rd.Down + rd.Up)
-			}
-			stateCode = GetStatusCode(upPercent)
-		}
-
-		if len(serviceCurrentStatusData.result) == _CurrentStatusSize {
-			serviceCurrentStatusData.t = currentTime
-			if !TSDBEnabled() {
-				rd := ss.serviceResponseDataStore[mh.GetId()]
+			} else {
 				if err := DB.Create(&model.ServiceHistory{
 					ServiceID: mh.GetId(),
-					AvgDelay:  rd.Delay,
+					AvgDelay:  ts.ping,
 					Data:      mh.Data,
-					Up:        rd.Up,
-					Down:      rd.Down,
+					ServerID:  r.Reporter,
 				}).Error; err != nil {
 					log.Printf("NEZHA>> Failed to save service monitor metrics: %v", err)
 				}
 			}
-			serviceCurrentStatusData.result = serviceCurrentStatusData.result[:0]
+			ts.count = 0
+			ts.ping = 0
+			ts.successCount = 0
 		}
-
-		m := ServerShared.GetList()
-		// 延迟报警
-		if mh.Delay > 0 {
-			delayCheck(&r, m, cs, mh)
-		}
-
-		// 状态变更报警+触发任务执行
-		if stateCode == StatusDown || stateCode != serviceCurrentStatusData.lastStatus {
-			lastStatus := serviceCurrentStatusData.lastStatus
-			// 存储新的状态值
-			serviceCurrentStatusData.lastStatus = stateCode
-
-			notifyCheck(&r, m, cs, mh, lastStatus, stateCode)
-		}
-
-		// TLS 证书报警
-		if ss.serviceReportBeforeTLSSideEffectsHook != nil {
-			ss.serviceReportBeforeTLSSideEffectsHook(mh.GetId())
-		}
-		var errMsg string
-		if strings.HasPrefix(mh.Data, "SSL证书错误：") {
-			// i/o timeout、connection timeout、EOF 错误
-			if !strings.HasSuffix(mh.Data, "timeout") &&
-				!strings.HasSuffix(mh.Data, "EOF") &&
-				!strings.HasSuffix(mh.Data, "timed out") {
-				errMsg = mh.Data
-				if cs.Notify {
-					muteLabel := NotificationMuteLabel.ServiceTLS(mh.GetId(), "network")
-					go NotificationShared.SendNotification(cs.NotificationGroupID, Localizer.Tf("[TLS] Fetch cert info failed, Reporter: %s, Error: %s", cs.Name, errMsg), muteLabel)
-				}
+		serviceTcpMap[r.Reporter] = ts
+	} else {
+		if TSDBEnabled() {
+			if err := TSDBShared.WriteServiceMetrics(&tsdb.ServiceMetrics{
+				ServiceID:  mh.GetId(),
+				ServerID:   r.Reporter,
+				Timestamp:  time.Now(),
+				Delay:      float64(mh.Delay),
+				Successful: mh.Successful,
+			}); err != nil {
+				log.Printf("NEZHA>> Failed to save service monitor metrics to TSDB: %v", err)
 			}
-		} else {
-			// 清除网络错误静音缓存
-			NotificationShared.UnMuteNotification(cs.NotificationGroupID, NotificationMuteLabel.ServiceTLS(mh.GetId(), "network"))
+		}
+	}
 
-			var newCert = strings.Split(mh.Data, "|")
-			if len(newCert) > 1 {
-				enableNotify := cs.Notify
+	// 写入当天状态
+	if mh.Successful {
+		serviceStatusToday.Delay = (serviceStatusToday.Delay*float64(serviceStatusToday.Up) +
+			float64(mh.Delay)) / float64(serviceStatusToday.Up+1)
+		serviceStatusToday.Up++
+	} else {
+		serviceStatusToday.Down++
+	}
 
-				// 首次获取证书信息时，缓存证书信息
-				if ss.tlsCertCache[mh.GetId()] == "" {
-					ss.tlsCertCache[mh.GetId()] = mh.Data
+	currentTime := time.Now()
+	if serviceCurrentStatusData.t.IsZero() {
+		serviceCurrentStatusData.t = currentTime
+	}
+
+	// 写入当前数据
+	if serviceCurrentStatusData.t.Before(currentTime) {
+		serviceCurrentStatusData.t = currentTime.Add(30 * time.Second)
+		serviceCurrentStatusData.result = append(serviceCurrentStatusData.result, mh)
+	}
+
+	// 更新当前状态
+	ss.serviceResponseDataStore[mh.GetId()] = serviceResponseData{}
+
+	// 永远是最新的 30 个数据的状态 [01:00, 02:00, 03:00] -> [04:00, 02:00, 03: 00]
+	for _, cs := range serviceCurrentStatusData.result {
+		if cs.GetId() > 0 {
+			rd := ss.serviceResponseDataStore[mh.GetId()]
+			if cs.Successful {
+				rd.Up++
+				rd.Delay = (rd.Delay*float64(rd.Up-1) + float64(cs.Delay)) / float64(rd.Up)
+			} else {
+				rd.Down++
+			}
+			ss.serviceResponseDataStore[mh.GetId()] = rd
+		}
+	}
+
+	// 计算在线率，
+	var stateCode uint8
+	{
+		upPercent := uint64(0)
+		rd := ss.serviceResponseDataStore[mh.GetId()]
+		if rd.Down+rd.Up > 0 {
+			upPercent = rd.Up * 100 / (rd.Down + rd.Up)
+		}
+		stateCode = GetStatusCode(upPercent)
+	}
+
+	if len(serviceCurrentStatusData.result) == _CurrentStatusSize {
+		serviceCurrentStatusData.t = currentTime
+		if !TSDBEnabled() {
+			rd := ss.serviceResponseDataStore[mh.GetId()]
+			if err := DB.Create(&model.ServiceHistory{
+				ServiceID: mh.GetId(),
+				AvgDelay:  rd.Delay,
+				Data:      mh.Data,
+				Up:        rd.Up,
+				Down:      rd.Down,
+			}).Error; err != nil {
+				log.Printf("NEZHA>> Failed to save service monitor metrics: %v", err)
+			}
+		}
+		serviceCurrentStatusData.result = serviceCurrentStatusData.result[:0]
+	}
+
+	// 延迟报警
+	if mh.Delay > 0 {
+		delayCheck(&r, m, cs, mh)
+	}
+
+	// 状态变更报警+触发任务执行
+	if stateCode == StatusDown || stateCode != serviceCurrentStatusData.lastStatus {
+		lastStatus := serviceCurrentStatusData.lastStatus
+		// 存储新的状态值
+		serviceCurrentStatusData.lastStatus = stateCode
+
+		notifyCheck(&r, m, cs, mh, lastStatus, stateCode)
+	}
+
+	// TLS 证书报警
+	if ss.serviceReportBeforeTLSSideEffectsHook != nil {
+		ss.serviceReportBeforeTLSSideEffectsHook(mh.GetId())
+	}
+	var errMsg string
+	if strings.HasPrefix(mh.Data, "SSL证书错误：") {
+		// i/o timeout、connection timeout、EOF 错误
+		if !strings.HasSuffix(mh.Data, "timeout") &&
+			!strings.HasSuffix(mh.Data, "EOF") &&
+			!strings.HasSuffix(mh.Data, "timed out") {
+			errMsg = mh.Data
+			if cs.Notify {
+				muteLabel := NotificationMuteLabel.ServiceTLS(mh.GetId(), "network")
+				go NotificationShared.SendNotification(cs.NotificationGroupID, Localizer.Tf("[TLS] Fetch cert info failed, Reporter: %s, Error: %s", cs.Name, errMsg), muteLabel)
+			}
+		}
+	} else {
+		// 清除网络错误静音缓存
+		NotificationShared.UnMuteNotification(cs.NotificationGroupID, NotificationMuteLabel.ServiceTLS(mh.GetId(), "network"))
+
+		var newCert = strings.Split(mh.Data, "|")
+		if len(newCert) > 1 {
+			enableNotify := cs.Notify
+
+			// 首次获取证书信息时，缓存证书信息
+			if ss.tlsCertCache[mh.GetId()] == "" {
+				ss.tlsCertCache[mh.GetId()] = mh.Data
+			}
+
+			oldCert := strings.Split(ss.tlsCertCache[mh.GetId()], "|")
+			isCertChanged := false
+			expiresOld, _ := time.Parse("2006-01-02 15:04:05 -0700 MST", oldCert[1])
+			expiresNew, _ := time.Parse("2006-01-02 15:04:05 -0700 MST", newCert[1])
+
+			// 证书变更时，更新缓存
+			if oldCert[0] != newCert[0] && !expiresNew.Equal(expiresOld) {
+				isCertChanged = true
+				ss.tlsCertCache[mh.GetId()] = mh.Data
+			}
+
+			notificationGroupID := cs.NotificationGroupID
+			serviceName := cs.Name
+
+			// 需要发送提醒
+			if enableNotify {
+				// 证书过期提醒
+				if expiresNew.Before(time.Now().AddDate(0, 0, 7)) {
+					expiresTimeStr := expiresNew.Format("2006-01-02 15:04:05")
+					errMsg = Localizer.Tf(
+						"The TLS certificate will expire within seven days. Expiration time: %s",
+						expiresTimeStr,
+					)
+
+					// 静音规则： 服务id+证书过期时间
+					// 用于避免多个监测点对相同证书同时报警
+					muteLabel := NotificationMuteLabel.ServiceTLS(mh.GetId(), fmt.Sprintf("expire_%s", expiresTimeStr))
+					go NotificationShared.SendNotification(notificationGroupID, fmt.Sprintf("[TLS] %s %s", serviceName, errMsg), muteLabel)
 				}
 
-				oldCert := strings.Split(ss.tlsCertCache[mh.GetId()], "|")
-				isCertChanged := false
-				expiresOld, _ := time.Parse("2006-01-02 15:04:05 -0700 MST", oldCert[1])
-				expiresNew, _ := time.Parse("2006-01-02 15:04:05 -0700 MST", newCert[1])
+				// 证书变更提醒
+				if isCertChanged {
+					errMsg = Localizer.Tf(
+						"TLS certificate changed, old: issuer %s, expires at %s; new: issuer %s, expires at %s",
+						oldCert[0], expiresOld.Format("2006-01-02 15:04:05"), newCert[0], expiresNew.Format("2006-01-02 15:04:05"))
 
-				// 证书变更时，更新缓存
-				if oldCert[0] != newCert[0] && !expiresNew.Equal(expiresOld) {
-					isCertChanged = true
-					ss.tlsCertCache[mh.GetId()] = mh.Data
-				}
-
-				notificationGroupID := cs.NotificationGroupID
-				serviceName := cs.Name
-
-				// 需要发送提醒
-				if enableNotify {
-					// 证书过期提醒
-					if expiresNew.Before(time.Now().AddDate(0, 0, 7)) {
-						expiresTimeStr := expiresNew.Format("2006-01-02 15:04:05")
-						errMsg = Localizer.Tf(
-							"The TLS certificate will expire within seven days. Expiration time: %s",
-							expiresTimeStr,
-						)
-
-						// 静音规则： 服务id+证书过期时间
-						// 用于避免多个监测点对相同证书同时报警
-						muteLabel := NotificationMuteLabel.ServiceTLS(mh.GetId(), fmt.Sprintf("expire_%s", expiresTimeStr))
-						go NotificationShared.SendNotification(notificationGroupID, fmt.Sprintf("[TLS] %s %s", serviceName, errMsg), muteLabel)
-					}
-
-					// 证书变更提醒
-					if isCertChanged {
-						errMsg = Localizer.Tf(
-							"TLS certificate changed, old: issuer %s, expires at %s; new: issuer %s, expires at %s",
-							oldCert[0], expiresOld.Format("2006-01-02 15:04:05"), newCert[0], expiresNew.Format("2006-01-02 15:04:05"))
-
-						// 证书变更后会自动更新缓存，所以不需要静音
-						go NotificationShared.SendNotification(notificationGroupID, fmt.Sprintf("[TLS] %s %s", serviceName, errMsg), "")
-					}
+					// 证书变更后会自动更新缓存，所以不需要静音
+					go NotificationShared.SendNotification(notificationGroupID, fmt.Sprintf("[TLS] %s %s", serviceName, errMsg), "")
 				}
 			}
 		}
-		ss.serviceResponseDataStoreLock.Unlock()
 	}
 }
 
@@ -776,17 +799,25 @@ func delayCheck(r *ReportData, m map[uint64]*model.Server, ss *model.Service, mh
 		return
 	}
 
+	// GHSA-jx78-55p5-rwv5 (incomplete fix of GHSA-qjpp-gffx-2wm9): the server
+	// map snapshot m is taken outside serviceResponseDataStoreLock and
+	// ServerShared has its own independent lock, so a concurrent batch-delete of
+	// the reporter's server can remove the entry between the pre-lock validation
+	// and this point.  Guard against the nil pointer before using the server.
+	reporterServer := m[r.Reporter]
+	if reporterServer == nil {
+		return
+	}
+
 	notificationGroupID := ss.NotificationGroupID
 	minMuteLabel := NotificationMuteLabel.ServiceLatencyMin(mh.GetId())
 	maxMuteLabel := NotificationMuteLabel.ServiceLatencyMax(mh.GetId())
 	if mh.Delay > ss.MaxLatency {
 		// 延迟超过最大值
-		reporterServer := m[r.Reporter]
 		msg := Localizer.Tf("[Latency] %s %2f > %2f, Reporter: %s", ss.Name, mh.Delay, ss.MaxLatency, reporterServer.Name)
 		go NotificationShared.SendNotification(notificationGroupID, msg, minMuteLabel)
 	} else if mh.Delay < ss.MinLatency {
 		// 延迟低于最小值
-		reporterServer := m[r.Reporter]
 		msg := Localizer.Tf("[Latency] %s %2f < %2f, Reporter: %s", ss.Name, mh.Delay, ss.MinLatency, reporterServer.Name)
 		go NotificationShared.SendNotification(notificationGroupID, msg, maxMuteLabel)
 	} else {
@@ -798,10 +829,16 @@ func delayCheck(r *ReportData, m map[uint64]*model.Server, ss *model.Service, mh
 
 func notifyCheck(r *ReportData, m map[uint64]*model.Server,
 	ss *model.Service, mh *pb.TaskResult, lastStatus, stateCode uint8) {
+	// GHSA-jx78-55p5-rwv5: guard against concurrent server deletion (same TOCTOU
+	// class as the 2026-07-21 fix, a few dozen lines lower in the same worker).
+	// ServerShared has its own lock; m is a snapshot taken outside
+	// serviceResponseDataStoreLock, so the server may have been removed between
+	// the pre-lock validation and here.
+	reporterServer := m[r.Reporter]
+
 	// 判断是否需要发送通知
 	isNeedSendNotification := ss.Notify && (lastStatus != 0 || stateCode == StatusDown)
-	if isNeedSendNotification {
-		reporterServer := m[r.Reporter]
+	if isNeedSendNotification && reporterServer != nil {
 		notificationGroupID := ss.NotificationGroupID
 		notificationMsg := Localizer.Tf("[%s] %s Reporter: %s, Error: %s", StatusCodeToString(stateCode), ss.Name, reporterServer.Name, mh.Data)
 		muteLabel := NotificationMuteLabel.ServiceStateChanged(mh.GetId())
@@ -816,8 +853,7 @@ func notifyCheck(r *ReportData, m map[uint64]*model.Server,
 
 	// 判断是否需要触发任务
 	isNeedTriggerTask := ss.EnableTriggerTask && lastStatus != 0
-	if isNeedTriggerTask {
-		reporterServer := m[r.Reporter]
+	if isNeedTriggerTask && reporterServer != nil {
 		if stateCode == StatusGood && lastStatus != stateCode {
 			// 当前状态正常 前序状态非正常时 触发恢复任务
 			go CronShared.SendTriggerTasks(ss.RecoverTriggerTasks, reporterServer.ID, ss.UserID)

service/singleton/servicesentinel_lifecycle_test.go

@@ -13,8 +13,183 @@ import (
 	"github.com/nezhahq/nezha/model"
 )
 
+// Regression markers for Finding 1 and Finding 2 of GHSA-jx78-55p5-rwv5
+// (incomplete fix of GHSA-qjpp-gffx-2wm9).
+const (
+	concurrentServerDeleteSuccessMarker = "ghsa-jx78-55p5-rwv5-finding1-no-crash"
+	deleteUnknownIDSuccessMarker        = "ghsa-jx78-55p5-rwv5-finding2-no-zombie"
+)
+
 const serviceSentinelLifecycleSuccessMarker = "service-sentinel-stale-report-lifecycle-success"
 
+func TestServiceSentinelReporterDeleteWaitsForSynchronousReportProcessing(t *testing.T) {
+	ctx, cancel := context.WithTimeout(t.Context(), time.Second)
+	defer cancel()
+	ss := newServiceMonitorSecurityHarness(t,
+		&model.Server{Common: model.Common{ID: 1, UserID: 1}, Name: "reporter"},
+	)
+	service := &model.Service{
+		Common:      model.Common{ID: 10, UserID: 1},
+		Name:        "lifecycle-service",
+		Type:        model.TaskTypeTCPPing,
+		Target:      "lifecycle.example.invalid:443",
+		Duration:    3600,
+		Cover:       model.ServiceCoverIgnoreAll,
+		SkipServers: map[uint64]bool{1: true},
+	}
+	addServiceMonitorSecurityService(t, ss, service)
+
+	reportValidated := make(chan struct{})
+	releaseReport := make(chan struct{})
+	var releaseOnce sync.Once
+	release := func() { releaseOnce.Do(func() { close(releaseReport) }) }
+	ss.serviceReportValidatedHook = func(serviceID uint64) {
+		if serviceID == service.ID {
+			close(reportValidated)
+			<-releaseReport
+		}
+	}
+	t.Cleanup(func() {
+		release()
+		ss.Close()
+	})
+
+	ss.Dispatch(serviceMonitorResult(1, service.ID, model.TaskTypeTCPPing, true))
+	select {
+	case <-reportValidated:
+	case <-ctx.Done():
+		t.Fatal(ctx.Err())
+	}
+
+	deleteDone := make(chan struct{})
+	go func() {
+		ServerShared.Delete([]uint64{1})
+		close(deleteDone)
+	}()
+	select {
+	case <-deleteDone:
+		t.Fatal("server deletion returned before the accepted report completed")
+	case <-time.After(25 * time.Millisecond):
+	}
+
+	release()
+	select {
+	case <-deleteDone:
+	case <-ctx.Done():
+		t.Fatal(ctx.Err())
+	}
+
+	var historyCount int64
+	if err := DB.Model(&model.ServiceHistory{}).
+		Where("service_id = ? AND server_id = ?", service.ID, 1).
+		Count(&historyCount).Error; err != nil {
+		t.Fatal(err)
+	}
+	if historyCount != 1 {
+		t.Fatalf("expected report side effects before deletion returned, got %d history rows", historyCount)
+	}
+	if _, ok := ServerShared.Get(1); ok {
+		t.Fatal("expected reporter to be deleted after the report completed")
+	}
+}
+
+func TestServiceSentinelWorkerRejectsReportAfterReporterDeletion(t *testing.T) {
+	ss := newServiceMonitorSecurityHarness(t,
+		&model.Server{Common: model.Common{ID: 1, UserID: 1}, Name: "reporter"},
+	)
+	service := &model.Service{
+		Common:      model.Common{ID: 10, UserID: 1},
+		Name:        "deleted-reporter-service",
+		Type:        model.TaskTypeTCPPing,
+		Target:      "deleted-reporter.example.invalid:443",
+		Duration:    3600,
+		Cover:       model.ServiceCoverIgnoreAll,
+		SkipServers: map[uint64]bool{1: true},
+	}
+	addServiceMonitorSecurityService(t, ss, service)
+
+	ServerShared.Delete([]uint64{1})
+	ss.Dispatch(serviceMonitorResult(1, service.ID, model.TaskTypeTCPPing, true))
+	ss.Close()
+
+	var historyCount int64
+	if err := DB.Model(&model.ServiceHistory{}).
+		Where("service_id = ? AND server_id = ?", service.ID, 1).
+		Count(&historyCount).Error; err != nil {
+		t.Fatal(err)
+	}
+	if historyCount != 0 {
+		t.Fatalf("expected no history after reporter deletion, got %d rows", historyCount)
+	}
+	ss.serviceResponseDataStoreLock.RLock()
+	_, pingCached := ss.serviceResponsePing[service.ID]
+	_, responseCached := ss.serviceResponseDataStore[service.ID]
+	stats := ss.serviceStatusToday[service.ID]
+	ss.serviceResponseDataStoreLock.RUnlock()
+	if pingCached {
+		t.Fatal("expected no ping cache side effect after reporter deletion")
+	}
+	if responseCached {
+		t.Fatal("expected no response cache side effect after reporter deletion")
+	}
+	if stats == nil || stats.Up != 0 || stats.Down != 0 {
+		t.Fatalf("expected no stats side effect after reporter deletion, got %+v", stats)
+	}
+}
+
+func TestServiceSentinelWorkerRecoversPerReportPanic(t *testing.T) {
+	ctx, cancel := context.WithTimeout(t.Context(), time.Second)
+	defer cancel()
+	ss := newServiceMonitorSecurityHarness(t,
+		&model.Server{Common: model.Common{ID: 1, UserID: 1}, Name: "reporter"},
+	)
+	panicService := &model.Service{
+		Common:      model.Common{ID: 10, UserID: 1},
+		Name:        "panic-service",
+		Type:        model.TaskTypeHTTPGet,
+		Target:      "https://panic.example.invalid",
+		Duration:    3600,
+		Cover:       model.ServiceCoverIgnoreAll,
+		SkipServers: map[uint64]bool{1: true},
+	}
+	validService := &model.Service{
+		Common:      model.Common{ID: 20, UserID: 1},
+		Name:        "valid-service",
+		Type:        model.TaskTypeTCPPing,
+		Target:      "valid.example.invalid:443",
+		Duration:    3600,
+		Cover:       model.ServiceCoverIgnoreAll,
+		SkipServers: map[uint64]bool{1: true},
+	}
+	addServiceMonitorSecurityService(t, ss, panicService)
+	addServiceMonitorSecurityService(t, ss, validService)
+	ss.serviceReportBeforeTLSSideEffectsHook = func(serviceID uint64) {
+		if serviceID == panicService.ID {
+			panic("test service report panic")
+		}
+	}
+
+	ss.Dispatch(serviceMonitorResult(1, panicService.ID, model.TaskTypeHTTPGet, true))
+	ss.Dispatch(serviceMonitorResult(1, validService.ID, model.TaskTypeTCPPing, true))
+	waitForServiceHistory(t, validService.ID, 1)
+	ss.Close()
+	if !ss.serviceResponseDataStoreLock.TryLock() {
+		t.Fatal("panic leaked the service response lock")
+	}
+	ss.serviceResponseDataStoreLock.Unlock()
+
+	deleteDone := make(chan struct{})
+	go func() {
+		ServerShared.Delete([]uint64{1})
+		close(deleteDone)
+	}()
+	select {
+	case <-deleteDone:
+	case <-ctx.Done():
+		t.Fatal("panic leaked a lifecycle lock: " + ctx.Err().Error())
+	}
+}
+
 func TestServiceSentinelWorkerIgnoresStaleReportAfterDeletion(t *testing.T) {
 	if os.Getenv("NEZHA_SERVICE_SENTINEL_LIFECYCLE_CHILD") == "1" {
 		testServiceSentinelWorkerIgnoresStaleReportAfterDeletionChild(t)
@@ -299,3 +474,173 @@ func TestServiceSentinelWorkerHoldsResponseLockDuringTLSSideEffects(t *testing.T
 		t.Fatalf("expected TLS cache %q, got %q", report.Data.Data, cachedCertificate)
 	}
 }
+
+// TestServiceSentinelWorkerSurvivesConcurrentReporterServerDelete is a
+// regression test for GHSA-jx78-55p5-rwv5 Finding 1 (incomplete fix of
+// GHSA-qjpp-gffx-2wm9).
+//
+// The vulnerability: after the 2026-07-21 fix, the worker re-validates the
+// service under serviceResponseDataStoreLock, but then takes a fresh snapshot
+// m := ServerShared.GetList() with no guard. A concurrent batch-delete of the
+// reporter's own server removes it between the pre-lock validation and the
+// GetList call, so m[r.Reporter] is nil.  delayCheck and notifyCheck then
+// dereference m[r.Reporter].Name unconditionally — SIGSEGV.
+//
+// The subprocess-isolation pattern is used because the pre-fix code path
+// panicked (nil pointer dereference in an unrecovered goroutine), which would
+// crash the whole test binary rather than simply failing a single test.
+func TestServiceSentinelWorkerSurvivesConcurrentReporterServerDelete(t *testing.T) {
+	if os.Getenv("NEZHA_SENTINEL_CONCURRENT_DELETE_CHILD") == "1" {
+		testServiceSentinelWorkerSurvivesConcurrentReporterServerDeleteChild(t)
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
+	defer cancel()
+	child := exec.CommandContext(ctx, os.Args[0],
+		"-test.run=^TestServiceSentinelWorkerSurvivesConcurrentReporterServerDelete$",
+		"-test.v",
+	)
+	child.Env = append(os.Environ(), "NEZHA_SENTINEL_CONCURRENT_DELETE_CHILD=1")
+
+	output, err := child.CombinedOutput()
+	if ctx.Err() != nil {
+		t.Fatalf("child process timed out: %v\n%s", ctx.Err(), output)
+	}
+	if err != nil {
+		t.Fatalf("child process crashed (likely nil deref in delayCheck/notifyCheck): %v\n%s", err, output)
+	}
+	if !strings.Contains(string(output), concurrentServerDeleteSuccessMarker) {
+		t.Fatalf("child did not print success marker:\n%s", output)
+	}
+}
+
+func testServiceSentinelWorkerSurvivesConcurrentReporterServerDeleteChild(t *testing.T) {
+	// Given: a reporter server and a service with latency-alerting enabled so
+	// that delayCheck (the vulnerable sink at line 785) is exercised on every
+	// dispatch.  MaxLatency=1 ensures delay=12 always exceeds the threshold and
+	// the notification branch (not just the mute-clear branch) is taken.
+	ss := newServiceMonitorSecurityHarness(t,
+		&model.Server{Common: model.Common{ID: 1, UserID: 1}, Name: "reporter"},
+	)
+	service := &model.Service{
+		Common:        model.Common{ID: 10, UserID: 1},
+		Name:          "latency-service",
+		Type:          model.TaskTypeTCPPing,
+		Target:        "example.invalid:443",
+		Duration:      3600,
+		Cover:         model.ServiceCoverIgnoreAll,
+		SkipServers:   map[uint64]bool{1: true},
+		LatencyNotify: true,
+		MaxLatency:    1,
+	}
+	addServiceMonitorSecurityService(t, ss, service)
+
+	reportProcessing := make(chan struct{})
+	releaseWorker := make(chan struct{})
+	var releaseOnce sync.Once
+	releaseWorkerFn := func() { releaseOnce.Do(func() { close(releaseWorker) }) }
+
+	// serviceReportValidatedHook runs while the report holds the lifecycle read
+	// lock. Deletion must therefore run in another goroutine and wait until this
+	// hook releases; attempting Delete here would try to upgrade the RWMutex.
+	ss.serviceReportValidatedHook = func(serviceID uint64) {
+		if serviceID == service.ID {
+			close(reportProcessing)
+			<-releaseWorker
+		}
+	}
+	t.Cleanup(func() {
+		releaseWorkerFn()
+		ss.Close()
+	})
+
+	// When
+	ss.Dispatch(serviceMonitorResult(1, service.ID, model.TaskTypeTCPPing, true))
+	select {
+	case <-reportProcessing:
+	case <-t.Context().Done():
+		t.Fatal(t.Context().Err())
+	}
+	deleteDone := make(chan struct{})
+	go func() {
+		ServerShared.Delete([]uint64{1})
+		close(deleteDone)
+	}()
+	releaseWorkerFn()
+	select {
+	case <-deleteDone:
+	case <-t.Context().Done():
+		t.Fatal(t.Context().Err())
+	}
+	ss.Close()
+
+	// Then: no crash; the worker handled the nil reporter gracefully.
+	if _, err := fmt.Fprintln(os.Stdout, concurrentServerDeleteSuccessMarker); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// TestServiceSentinelDeleteWithUnknownIDDoesNotLeaveZombies is a regression
+// test for GHSA-jx78-55p5-rwv5 Finding 2 (low severity).
+//
+// The vulnerability: ServiceSentinel.Delete iterates the caller-supplied id
+// slice and does CronShared.Remove(ss.services[id].CronJobID) without checking
+// whether id is present in ss.services.  CheckPermission returns vacuously
+// true for unknown ids, so the controller layer cannot block this path.
+// ss.services[unknownID] returns nil, and .CronJobID panics.  Because the
+// panic aborts the loop, every id ordered AFTER the bogus one is never removed
+// from the in-memory registry even though its database row was already deleted,
+// producing zombie services that keep dispatching cron probes.
+func TestServiceSentinelDeleteWithUnknownIDDoesNotLeaveZombies(t *testing.T) {
+	// Given: one legitimate service (ID 10) registered in the sentinel.
+	ss := newServiceMonitorSecurityHarness(t,
+		&model.Server{Common: model.Common{ID: 1, UserID: 1}, Name: "reporter"},
+	)
+	service := &model.Service{
+		Common:      model.Common{ID: 10, UserID: 1},
+		Name:        "real-service",
+		Type:        model.TaskTypeTCPPing,
+		Target:      "example.invalid:443",
+		Duration:    3600,
+		Cover:       model.ServiceCoverIgnoreAll,
+		SkipServers: map[uint64]bool{1: true},
+	}
+	addServiceMonitorSecurityService(t, ss, service)
+
+	// When: Delete is called with a bogus ID first, then the real service ID.
+	// Before the fix this panicked on ss.services[99999].CronJobID and left
+	// service 10 as a zombie.
+	ss.Delete([]uint64{99999, service.ID})
+
+	// Then: the real service must be fully removed from every in-memory map.
+	ss.serviceResponseDataStoreLock.RLock()
+	_, todayPresent := ss.serviceStatusToday[service.ID]
+	_, pingPresent := ss.serviceResponsePing[service.ID]
+	ss.serviceResponseDataStoreLock.RUnlock()
+
+	ss.servicesLock.RLock()
+	_, servicePresent := ss.services[service.ID]
+	ss.servicesLock.RUnlock()
+
+	ss.monthlyStatusLock.Lock()
+	_, monthlyPresent := ss.monthlyStatus[service.ID]
+	ss.monthlyStatusLock.Unlock()
+
+	if todayPresent {
+		t.Error("zombie: serviceStatusToday still contains the deleted service")
+	}
+	if pingPresent {
+		t.Error("zombie: serviceResponsePing still contains the deleted service")
+	}
+	if servicePresent {
+		t.Error("zombie: services map still contains the deleted service")
+	}
+	if monthlyPresent {
+		t.Error("zombie: monthlyStatus still contains the deleted service")
+	}
+
+	if _, err := fmt.Fprintln(os.Stdout, deleteUnknownIDSuccessMarker); err != nil {
+		t.Fatal(err)
+	}
+}

service/singleton/testhelpers.go

@@ -20,6 +20,9 @@ func NewEmptyServerClassForTest() *ServerClass {
 // InsertForTest 把一个 server 直接塞进内存表与排序快照，跳过 DB & InitServer 逻辑。
 // 调用方需保证 server.ID 已经设置。
 func (c *ServerClass) InsertForTest(s *model.Server) {
+	c.lockLifecycleWrite()
+	defer c.unlockLifecycleWrite()
+
 	c.listMu.Lock()
 	c.list[s.ID] = s
 	if s.UUID != "" {