GHSA-jg62-j5h6-8mpq: the terminal and file-manager endpoints created unbounded
IO streams; an authenticated member could open thousands, each spawning
goroutines, a 1MiB buffer and an agent-side PTY, exhausting dashboard and agent
resources. CreateStream now enforces a per-user (20) and per-server (40) cap in
the existing ioStreamMutex critical section, using the stream map as the single
source of truth. Dashboard-internal streams (uid==0: NAT, server transfer, MCP
transfer) skip the per-user cap but still count per-server. Adds caps,
exemption, slot-release and no-leak regression tests.
In ConfigUsePeerIP mode ctxWithRealIP validated connectingIp but never
assigned it to ip, so CtxKeyRealIP was left empty. model.CheckIP and
model.BlockIP short-circuit on an empty IP, which silently disabled the
gRPC WAF block table and brute-force token counters for every peer-IP
deployment — including the stream interceptors this path now backs.
Assign ip = connectingIp so the WAF and BlockIP observe the source. The
empty-header path is unchanged (it intentionally opts out of IP WAF).
Add rpc_test.go covering peer-IP IPv4/IPv6, the no-peer error, and the
no-header opt-out so the behaviours cannot be re-coupled.
Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
- ServeRPC now applies real-IP + WAF interceptors to streaming RPCs
(RequestTask, IOStream), not just unary calls; without them
authHandler.check saw an empty real IP so brute-force BlockIP counters
never keyed on a source and the WAF block table was bypassed at the
stream entrypoint. Factored real-IP resolution into ctxWithRealIP shared
by unary and stream paths.
- handleFsRead rejects negative offset/length; handleFsWrite validates
if_match_sha256 is 64 hex chars before dispatch.
- createAPIToken always verifies each server_id exists (even for admins),
so an admin cannot bind a PAT to a not-yet-created server id that a
future server would auto-inherit.
- Add relay zero-length-chunk rejection regression test.
Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
Introduce Personal Access Tokens (nzp_*) as a stateless auth path alongside
JWT, gated per-endpoint by a scope middleware (nezha:{resource}:{verb}) with
fail-closed empty-scope defaults and a server-id whitelist. Self-management
endpoints (profile, api-tokens, oauth2 bind, refresh-token) explicitly reject
PATs to block privilege-escalation chains. A revoke registry tears down active
long-lived connections (terminal, fm, ws, transfer, mcp) the moment a PAT is
deleted, with a tombstone closing the revoke->register race.
Add an MCP endpoint that proxies tool calls (exec, fs read/write/delete,
transfer) to agents over gRPC, guarded by origin/DNS-rebinding checks, a
per-token rate limiter, audit logging, and a kill switch. Serialize all
sends through the IOStream wrapper to honour grpc-go's concurrency contract.
Add CSRF double-submit protection on unsafe cookie-authenticated methods,
exempting authenticated PAT requests by context identity (not a forgeable
Authorization header). Apply visibility/whitelist filtering consistently
across list, get-by-id, and mutate paths to enforce tenant isolation.
Migrate legacy mcp:* scopes: rewrite read/exec to nezha:* equivalents and
drop dangerous write/delete/wildcard grants.
Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
createTerminal and createFM correctly check server ownership before
issuing a stream UUID, but terminalStream and fmStream only verified
that the UUID existed. Any authenticated user holding a valid stream
UUID could attach to it, gaining the original creator's live shell or
file-manager session — and the UUID is exposed via URL path (referer
leaks, access logs, browser history, frontend error reporters).
Bind the creator user ID into ioStreamContext at CreateStream time,
expose StreamOwnership and IsStreamAuthorizedForUser, and check
ownership in terminalStream/fmStream before the WebSocket upgrade so a
rejected attempt does not tear down the legitimate stream via defer.
NAT streams are also routed through CreateStream(_, 0); they are not
reachable from /ws/terminal or /ws/file so a sentinel user ID is fine.
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
* test(deps): use self admin-frontend
* feat: separate real ip header of frontend/agent
* test(ci): test
* Revert "test(ci): test"
This reverts commit 1634c7e7d7bca2873c13955abb582ea88645844f.
* test(ci): test
* test(ci): test
* test(ci): test
* Revert "test(ci): test"
This reverts commit 8fce20a07e5a9503f665937337050d4373ca7e78.
* Revert "test(ci): test"
This reverts commit 3267cccbfb81776a711e8cb34e676536f0852d1c.
* Revert "test(ci): test"
This reverts commit 566660c0c6a9875864aa46537bcc6788769337eb.
* Revert "test(deps): use self admin-frontend"
This reverts commit 16a838b374ff040800b2c1c5f8e5ede577645669.
* feat: support listening https
* refactor
* modernize
* support snake case in config
* more precise control of config fields
* update goreleaser config
* remove kubeyaml
* fix: expose agent_secret
* chore
naiba
UUBulb
TomyJan
Ko no dioandLvGJ
Lemoe