fix(security): reserve dashboard hosts from NAT and re-check DDNS profile ownership at worker time

GHSA-x6fg-52vr-hj4w: NAT is a commonHandler any authenticated member can
create, and newHTTPandGRPCMux matches r.Host against NAT before dispatching
the dashboard/gRPC handlers, so a member could register the dashboard's own
host as a NAT Domain and hijack global routing. Add IsReservedDashboardHost
(InstallHost/ListenHost plus an operator-declared ReservedHosts list for
reverse-proxy deployments), reject reserved hosts on create/update, and drop
pre-planted records when building the startup cache.

GHSA-39g2-8x68-pmx8: bind-time CheckPermission let a member pre-bind a DDNS
profile ID that the victim would only create later. GetDDNSProvidersFromProfiles
now re-validates ownership by server owner UID and skips foreign-owned
profiles (UserID==0 is treated as a migration artifact, not an admin grant).

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

cmd/dashboard/controller/nat.go

@@ -64,6 +64,10 @@ func createNAT(c *gin.Context) (uint64, error) {
 		return 0, singleton.Localizer.ErrorT("permission denied")
 	}
 
+	if singleton.IsReservedDashboardHost(nf.Domain) {
+		return 0, singleton.Localizer.ErrorT("permission denied")
+	}
+
 	uid := getUid(c)
 
 	n.UserID = uid
@@ -117,6 +121,10 @@ func updateNAT(c *gin.Context) (any, error) {
 		return nil, singleton.Localizer.ErrorT("permission denied")
 	}
 
+	if singleton.IsReservedDashboardHost(nf.Domain) {
+		return nil, singleton.Localizer.ErrorT("permission denied")
+	}
+
 	var n model.NAT
 	if err = singleton.DB.First(&n, id).Error; err != nil {
 		return nil, singleton.Localizer.ErrorT("profile id %d does not exist", id)

cmd/dashboard/controller/setting.go

@@ -99,6 +99,7 @@ func updateConfig(c *gin.Context) (any, error) {
 	singleton.Conf.EnablePlainIPInNotification = sf.EnablePlainIPInNotification
 	singleton.Conf.Cover = sf.Cover
 	singleton.Conf.InstallHost = sf.InstallHost
+	singleton.Conf.ReservedHosts = sf.ReservedHosts
 	singleton.Conf.IgnoredIPNotification = sf.IgnoredIPNotification
 	singleton.Conf.IPChangeNotificationGroupID = sf.IPChangeNotificationGroupID
 	singleton.Conf.SiteName = sf.SiteName

cmd/dashboard/controller/setting_reserved_hosts_test.go

@@ -0,0 +1,24 @@
+package controller
+
+import (
+	"bytes"
+	"encoding/json"
+	"testing"
+
+	"github.com/nezhahq/nezha/model"
+)
+
+// GHSA-x6fg-52vr-hj4w: the admin settings endpoint must accept reserved_hosts
+// so a reverse-proxy operator can declare the public dashboard hostnames the
+// process itself never sees. Without binding here, the only way to set the
+// field would be hand-editing the YAML, defeating the in-product guard.
+func TestSettingForm_BindsReservedHosts(t *testing.T) {
+	body := []byte(`{"site_name":"X","reserved_hosts":"panel.example.com, admin.example.com"}`)
+	var sf model.SettingForm
+	if err := json.NewDecoder(bytes.NewReader(body)).Decode(&sf); err != nil {
+		t.Fatal(err)
+	}
+	if sf.ReservedHosts != "panel.example.com, admin.example.com" {
+		t.Fatalf("reserved_hosts must decode into SettingForm, got %q", sf.ReservedHosts)
+	}
+}