Buriburizaemon/nezha_domains
1
0
Fork 0
mirror of https://github.com/Buriburizaem0n/nezha_domains.git synced 2026-09-19 17:50:12 +00:00
Code Issues Packages Projects Releases Wiki Activity
3,971 Commits 1 Branch 2 Tags
1405ba76e567f666248879aa0742248a53a3629c
Commit Graph
3971 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
naibaandnaiba/CloudCode e7c2e453c0 fix(ddns): apply SSRF defense to webhook provider 
GHSA-6x26-5727-rrm9: a low-privilege member could point a DDNS webhook
at internal or loopback hosts and the dashboard would dial them with the
unrestricted utils.HttpClient.

Extract the notification SSRF defenses (CIDR blocklist, IP-pin DialContext,
SNI preservation, redirect rejection) into reusable helpers in pkg/utils
(NewRestrictedHTTPClient / ResolveAllowedHTTPURL / buildRestrictedHTTPClient)
and route the DDNS webhook through the same path. Replace the notification
inline implementation with a thin wrapper to keep behaviour identical.

Side improvements collected by the refactor:
- prepareRequest now resolves DNS once and returns the paired client, so
  the dialer's pinned IP and the validated URL stay in sync (no more
  double resolution between prepareRequest and SetRecords).
- response body is drained and closed.
- HttpClient / HttpClientSkipTlsVerify are explicitly tagged unsafe for
  attacker-controlled URLs.

Tests cover: hermetic SNI preservation, redirect rejection, dial pin to
the vetted IP, the full blocked-CIDR list at the webhook entry point,
and the verifyTLS↔skipVerifyTLS inversion in the notification wrapper.

Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-05-18 15:14:27 +00:00
naibaandnaiba/CloudCode b2294f11dd fix(ws): scope server stream visibility to viewer ownership 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-05-17 03:41:28 +00:00
naibaandnaiba/CloudCode 05e5da2535 fix(ws): scope server stream visibility to viewer ownership 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-05-17 03:41:28 +00:00
naibaandnaiba/CloudCode 2b6a1430ff chore(deps): upgrade go modules to latest 
Bumps direct deps: VictoriaMetrics v1.134.0 -> v1.143.0,
gin-contrib/pprof v1.5.3 -> v1.5.4, knadh/koanf/v2 v2.3.3 -> v2.3.4,
libdns/he v1.2.1 -> v1.2.2, tidwall/gjson v1.18.0 -> v1.19.0,
golang.org/x/crypto v0.49.0 -> v0.51.0,
golang.org/x/net v0.52.0 -> v0.54.0,
google.golang.org/grpc v1.79.3 -> v1.81.1, plus transitive updates.

VictoriaMetrics v1.143.0 requires go >= 1.26.3, so the go directive
is bumped from 1.26 to 1.26.3.

Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-05-17 02:40:09 +00:00
naibaandnaiba/CloudCode e1244ca372 chore(deps): upgrade go modules to latest 
Bumps direct deps: VictoriaMetrics v1.134.0 -> v1.143.0,
gin-contrib/pprof v1.5.3 -> v1.5.4, knadh/koanf/v2 v2.3.3 -> v2.3.4,
libdns/he v1.2.1 -> v1.2.2, tidwall/gjson v1.18.0 -> v1.19.0,
golang.org/x/crypto v0.49.0 -> v0.51.0,
golang.org/x/net v0.52.0 -> v0.54.0,
google.golang.org/grpc v1.79.3 -> v1.81.1, plus transitive updates.

VictoriaMetrics v1.143.0 requires go >= 1.26.3, so the go directive
is bumped from 1.26 to 1.26.3.

Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-05-17 02:40:09 +00:00
naibaandnaiba/CloudCode 854e2edf17 chore: bump admin frontend to v2.0.7 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-05-17 10:24:19 +08:00
naibaandnaiba/CloudCode 9f21db2dc6 chore: bump admin frontend to v2.0.7 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-05-17 10:24:19 +08:00
naibaandnaiba/CloudCode 7061651587 test: cover multi-user permission boundaries 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-05-17 10:24:19 +08:00
naibaandnaiba/CloudCode c0e2470a9d test: cover multi-user permission boundaries 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-05-17 10:24:19 +08:00
naibaandnaiba/CloudCode 2573ba7522 fix(controller): restrict waf and online-user listings to admins 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-05-17 10:24:19 +08:00
naibaandnaiba/CloudCode 530722293f fix(controller): restrict waf and online-user listings to admins 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-05-17 10:24:19 +08:00
naibaandnaiba/CloudCode 0ca7ee38c0 fix(controller): filter listing endpoints by ownership 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-05-17 10:24:19 +08:00
naibaandnaiba/CloudCode acc2b63ce2 fix(controller): filter listing endpoints by ownership 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-05-17 10:24:19 +08:00
naibaandnaiba/CloudCode 2a65a7db80 fix(controller): enforce ownership on notification group, NAT server, and batch move 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-05-17 10:24:19 +08:00
naibaandnaiba/CloudCode a5995ce045 fix(controller): enforce ownership on notification group, NAT server, and batch move 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-05-17 10:24:19 +08:00
naibaandnaiba/CloudCode 58f98db1a0 fix(controller): validate trigger task ownership 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-05-17 10:24:19 +08:00
naibaandnaiba/CloudCode 423175a425 fix(controller): validate trigger task ownership 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-05-17 10:24:19 +08:00
naibaandnaiba/CloudCode e38a0ef469 fix(cron): restrict task delivery by owner 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-05-17 10:24:19 +08:00
naibaandnaiba/CloudCode d7526351cf fix(cron): restrict task delivery by owner 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-05-17 10:24:19 +08:00
naibaandnaiba/CloudCode c4bea1ffd3 fix(notification): harden webhook request handling 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-05-17 10:24:19 +08:00
naibaandnaiba/CloudCode d06d539d34 fix(notification): harden webhook request handling 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-05-17 10:24:19 +08:00
uubulb 3e889dc3d9 fix(OnUserDelete): only delete current iterated user from db 2026-05-09 12:38:39 +08:00
uubulb 85b0dd2992 fix(OnUserDelete): only delete current iterated user from db 2026-05-09 12:38:39 +08:00
naiba 027cb5f4b7 chore: upgrade frontend 2026-04-05 10:00:11 +08:00
naiba 50dc8e6603 chore: upgrade frontend 2026-04-05 10:00:11 +08:00
naibaandnaiba/CloudCode 241506e390 chore: bump Go to 1.26, update dependencies and frontend templates 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-03-20 11:23:03 +00:00
naibaandnaiba/CloudCode 9acffc11f6 chore: bump Go to 1.26, update dependencies and frontend templates 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-03-20 11:23:03 +00:00
naiba 5c07c3befb Merge pull request #1177 from nezhahq/dependabot/go_modules/google.golang.org/grpc-1.79.3 
chore(deps): bump google.golang.org/grpc from 1.76.0 to 1.79.3
 2026-03-20 18:39:37 +08:00
naiba 4e9513501f Merge pull request #1177 from nezhahq/dependabot/go_modules/google.golang.org/grpc-1.79.3 
chore(deps): bump google.golang.org/grpc from 1.76.0 to 1.79.3
 2026-03-20 18:39:37 +08:00
dependabot[bot] 87bf588a10 chore(deps): bump google.golang.org/grpc from 1.76.0 to 1.79.3 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.76.0 to 1.79.3.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.76.0...v1.79.3)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.79.3
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-19 02:27:20 +00:00
dependabot[bot] 91a636ce25 chore(deps): bump google.golang.org/grpc from 1.76.0 to 1.79.3 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.76.0 to 1.79.3.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.76.0...v1.79.3)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.79.3
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-19 02:27:20 +00:00
naibaandnaiba/CloudCode de9ab16c5a fix: 恢复被误删的 AuthCodeURL 调用，修复编译失败 
上次提交误删了 url := o2conf.AuthCodeURL(...) 导致编译失败。
同时添加注释说明 Cookie Secure 属性动态设置的原因。

Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-03-01 04:05:53 +00:00
naibaandnaiba/CloudCode a5d4537a8c fix: 恢复被误删的 AuthCodeURL 调用，修复编译失败 
上次提交误删了 url := o2conf.AuthCodeURL(...) 导致编译失败。
同时添加注释说明 Cookie Secure 属性动态设置的原因。

Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-03-01 04:05:53 +00:00
naiba 0f9bc2d3ee chore: upgrade frontend 2026-03-01 11:50:56 +08:00
naiba 589563e744 chore: upgrade frontend 2026-03-01 11:50:56 +08:00
naibaandnaiba/CloudCode 16c4a6c9f3 Fix: 设置Cookie Secure属性增强安全性 
- 根据运行环境动态设置Secure属性
- 开发环境兼容HTTP，生产环境强制HTTPS
- 解决CodeQL扫描发现的安全漏洞

Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-03-01 03:49:20 +00:00
naibaandnaiba/CloudCode d57d7b73b6 Fix: 设置Cookie Secure属性增强安全性 
- 根据运行环境动态设置Secure属性
- 开发环境兼容HTTP，生产环境强制HTTPS
- 解决CodeQL扫描发现的安全漏洞

Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-03-01 03:49:20 +00:00
github-actions[bot] 7907400dbd update contributors[no ci] 2026-03-01 11:33:11 +08:00
github-actions[bot] 69ac37d98c update contributors[no ci] 2026-03-01 11:33:11 +08:00
naibaandnaiba/CloudCode 2a04897140 fix: upgrade CodeQL Action to v3 and generate swagger docs before build 
- Upgrade github/codeql-action from v2 to v3 (v1/v2 deprecated)
- Upgrade actions/setup-go from v4 to v5
- Add swag init step before autobuild to generate cmd/dashboard/docs
  package, fixing "could not import: invalid package name" warning

Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-03-01 03:32:49 +00:00
naibaandnaiba/CloudCode be8ff11cae fix: upgrade CodeQL Action to v3 and generate swagger docs before build 
- Upgrade github/codeql-action from v2 to v3 (v1/v2 deprecated)
- Upgrade actions/setup-go from v4 to v5
- Add swag init step before autobuild to generate cmd/dashboard/docs
  package, fixing "could not import: invalid package name" warning

Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
 2026-03-01 03:32:49 +00:00
github-actions[bot] 6caaea1651 update contributors[no ci] 2026-02-28 23:24:16 +08:00
github-actions[bot] c48c63c8ad update contributors[no ci] 2026-02-28 23:24:16 +08:00
奶爸 f2bb324d67 Merge pull request #1172 from NikoCat233/fix/guest-server-group-filter 
Filter hidden servers in guest server-group API
 2026-02-28 23:23:56 +08:00
奶爸 59b8ea3ce7 Merge pull request #1172 from NikoCat233/fix/guest-server-group-filter 
Filter hidden servers in guest server-group API
 2026-02-28 23:23:56 +08:00
NikoCat233 a42ef6e8bb Filter hidden servers in guest server-group API 2026-02-27 00:53:31 +08:00
NikoCat233 1a0d915afa Filter hidden servers in guest server-group API 2026-02-27 00:53:31 +08:00
Weblate (bot)andnlimeres 407017b1f6 Added translation using Weblate (Galician) (#1168) 
Co-authored-by: nlimeres <dynosaurioprogramador@gmail.com>
 2026-02-19 14:35:24 +08:00
Weblate (bot)andnlimeres 04553ca17f Added translation using Weblate (Galician) (#1168) 
Co-authored-by: nlimeres <dynosaurioprogramador@gmail.com>
 2026-02-19 14:35:24 +08:00
naiba fa7afd475f chore: bump admin-frontend to v2.0.4, nezha-dash-v1 to v2.0.1 2026-02-19 06:34:02 +00:00