mirror of
https://github.com/Buriburizaem0n/nezha_domains.git
synced 2026-09-19 09:40:12 +00:00
naibaandcloudcode
d4837dfc7a
GHSA-x6fg-52vr-hj4w: NAT is a commonHandler any authenticated member can create, and newHTTPandGRPCMux matches r.Host against NAT before dispatching the dashboard/gRPC handlers, so a member could register the dashboard's own host as a NAT Domain and hijack global routing. Add IsReservedDashboardHost (InstallHost/ListenHost plus an operator-declared ReservedHosts list for reverse-proxy deployments), reject reserved hosts on create/update, and drop pre-planted records when building the startup cache. GHSA-39g2-8x68-pmx8: bind-time CheckPermission let a member pre-bind a DDNS profile ID that the victim would only create later. GetDDNSProvidersFromProfiles now re-validates ownership by server owner UID and skips foreign-owned profiles (UserID==0 is treated as a migration artifact, not an admin grant). Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
25 lines
833 B
Go
25 lines
833 B
Go
package controller
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/json"
|
|
"testing"
|
|
|
|
"github.com/nezhahq/nezha/model"
|
|
)
|
|
|
|
// GHSA-x6fg-52vr-hj4w: the admin settings endpoint must accept reserved_hosts
|
|
// so a reverse-proxy operator can declare the public dashboard hostnames the
|
|
// process itself never sees. Without binding here, the only way to set the
|
|
// field would be hand-editing the YAML, defeating the in-product guard.
|
|
func TestSettingForm_BindsReservedHosts(t *testing.T) {
|
|
body := []byte(`{"site_name":"X","reserved_hosts":"panel.example.com, admin.example.com"}`)
|
|
var sf model.SettingForm
|
|
if err := json.NewDecoder(bytes.NewReader(body)).Decode(&sf); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if sf.ReservedHosts != "panel.example.com, admin.example.com" {
|
|
t.Fatalf("reserved_hosts must decode into SettingForm, got %q", sf.ReservedHosts)
|
|
}
|
|
}
|