nezha_domains

mirror of https://github.com/Buriburizaem0n/nezha_domains.git synced 2026-09-19 09:40:12 +00:00

T

naibaandnaiba/CloudCode ea7ad67f03 fix(ddns): apply SSRF defense to webhook provider

GHSA-6x26-5727-rrm9: a low-privilege member could point a DDNS webhook
at internal or loopback hosts and the dashboard would dial them with the
unrestricted utils.HttpClient.

Extract the notification SSRF defenses (CIDR blocklist, IP-pin DialContext,
SNI preservation, redirect rejection) into reusable helpers in pkg/utils
(NewRestrictedHTTPClient / ResolveAllowedHTTPURL / buildRestrictedHTTPClient)
and route the DDNS webhook through the same path. Replace the notification
inline implementation with a thin wrapper to keep behaviour identical.

Side improvements collected by the refactor:
- prepareRequest now resolves DNS once and returns the paired client, so
  the dialer's pinned IP and the validated URL stay in sync (no more
  double resolution between prepareRequest and SetRecords).
- response body is drained and closed.
- HttpClient / HttpClientSkipTlsVerify are explicitly tagged unsafe for
  attacker-controlled URLs.

Tests cover: hermetic SNI preservation, redirect rejection, dial pin to
the vetted IP, the full blocked-CIDR list at the webhook entry point,
and the verifyTLS↔skipVerifyTLS inversion in the notification wrapper.

Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>

2026-05-18 15:14:27 +00:00

.devcontainer

ci: use go1.24 (#1012 )

2025-02-28 22:19:57 +08:00

.github

chore: bump Go to 1.26, update dependencies and frontend templates

2026-03-20 11:23:03 +00:00

cmd/dashboard

fix(ws): scope server stream visibility to viewer ownership

2026-05-17 03:41:28 +00:00

model

fix(ddns): apply SSRF defense to webhook provider

2026-05-18 15:14:27 +00:00

pkg

fix(ddns): apply SSRF defense to webhook provider

2026-05-18 15:14:27 +00:00

proto

improve: geoip

2025-02-09 14:39:12 +08:00

script

feat: upgrade frontend

2025-03-22 22:44:25 +08:00

service

chore: bump admin frontend to v2.0.7

2026-05-17 10:24:19 +08:00

.gitattributes

💄 UI: 前端优化调整

2021-01-30 11:22:59 +08:00

.gitignore

Refactor: Load UserTemplates from embedded yaml file (#575 )

2024-12-10 21:57:20 +08:00

.goreleaser.yml

feat(v2.0.0): tsdb (#1162 )

2026-02-15 13:13:33 +08:00

Dockerfile

fix: embed tzdata to correct container timezone (#1126 )

2025-10-03 09:33:12 +08:00

go.mod

chore(deps): upgrade go modules to latest

2026-05-17 02:40:09 +00:00

go.sum

chore(deps): upgrade go modules to latest

2026-05-17 02:40:09 +00:00

LICENSE

Create LICENSE

2021-03-22 17:41:38 +08:00

README.md

update contributors[no ci]

2026-03-01 11:33:11 +08:00

SECURITY.md

Create SECURITY.md [skip ci]

2022-04-18 10:47:29 +08:00

README.md

LOGO designed by 熊大 .

:trollface: Nezha Monitoring: Self-hostable, lightweight, servers and websites monitoring and O&M tool.

Supports monitoring system status, HTTP (SSL certificate change, upcoming expiration, expired), TCP, Ping and supports push alerts, run scheduled tasks and web terminal.

>> Telegram Channel: 哪吒监控（中文通知频道）
>> Telegram Group: Nezha Monitoring Global (English Only), 哪吒监控（中文群组）

>> Use Cases | 我们的用户 (Google)