naiba fb5c37e983 fix(oauth2): validate Host header against allowlist for callback URL ...

GHSA-9rc6-8cjv-rcvx: getRedirectURL derived the OAuth2 callback URL from the
raw Host header, so a forged Host (or a provider with loose redirect-URI
matching) could divert a victim's authorization code to an attacker origin and
bind their identity. Trust the request Host only when it is an operator-declared
dashboard host (IsReservedDashboardHost, same allowlist guarding NAT routing);
otherwise fall back to the configured InstallHost.

2026-06-05 02:42:28 +00:00

..

admin-dist

feat: embed dist

2024-11-29 21:31:39 +08:00

controller

fix(oauth2): validate Host header against allowlist for callback URL

2026-06-05 02:42:28 +00:00

rpc

fix(security): set real IP from peer in ConfigUsePeerIP gRPC mode

2026-05-31 07:45:23 +00:00

user-dist

feat: embed dist

2024-11-29 21:31:39 +08:00

main.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00