naiba fb5c37e983 fix(oauth2): validate Host header against allowlist for callback URL ...

GHSA-9rc6-8cjv-rcvx: getRedirectURL derived the OAuth2 callback URL from the
raw Host header, so a forged Host (or a provider with loose redirect-URI
matching) could divert a victim's authorization code to an attacker origin and
bind their identity. Trust the request Host only when it is an operator-declared
dashboard host (IsReservedDashboardHost, same allowlist guarding NAT routing);
otherwise fall back to the configured InstallHost.

2026-06-05 02:42:28 +00:00

..

waf

fix: add a default error message for waf page (#1145)

2025-12-04 21:52:12 +08:00

alertrule_pat_fanout_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

alertrule.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_legacy_migration_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_optional_scope_test.go

feat(auth): split inventory scope out of server scope

2026-05-31 15:14:41 +00:00

api_token_revoke_registry_race_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_revoke_registry_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_revoke_registry.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_scope_empty_doc_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_scope_test.go

feat(auth): split inventory scope out of server scope

2026-05-31 15:14:41 +00:00

api_token_scope.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_server_config_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_server_whitelist_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_test.go

fix(security): harden gRPC stream WAF, MCP fs arg validation, and PAT server binding

2026-05-31 05:51:32 +00:00

api_token.go

ci(gosec): silence G101 false positives on PAT context keys and scope const

2026-05-31 08:16:55 +00:00

batch_move_pat_whitelist_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

controller.go

feat(auth): split inventory scope out of server scope

2026-05-31 15:14:41 +00:00

cron_cover_validation_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

cron_dispatch_pat_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

cron_list_pat_whitelist_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

cron_manual_csrf_test.go

fix(cron): switch manual trigger to POST to defeat CSRF

2026-05-26 03:59:50 +00:00

cron_pat_whitelist_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

cron_service_cover_pat_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

cron_update_owner_uid_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

cron.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

csrf_signed_test.go

fix(security): verify transfer-token HMAC and sign CSRF double-submit cookie

2026-05-31 05:48:50 +00:00

csrf_test.go

fix(security): verify transfer-token HMAC and sign CSRF double-submit cookie

2026-05-31 05:48:50 +00:00

csrf.go

fix(csrf): set Secure on csrf cookie only over HTTPS

2026-06-05 01:08:00 +00:00

ddns.go

ddns: support provider hurricane electric (#1036)

2025-03-19 21:52:16 +08:00

fm.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

force_update_ownership_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

frontend_fallback_api_tokens_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

frontend_fallback_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

jwt_session_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

jwt_test.go

test: cover multi-user permission boundaries

2026-05-17 10:24:19 +08:00

jwt.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_audit.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_body_limit_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_capability_test.go

fix(mcp): accept agents reporting version without v prefix and stop masking tool errors

2026-05-31 16:18:57 +00:00

mcp_capability.go

fix(mcp): accept agents reporting version without v prefix and stop masking tool errors

2026-05-31 16:18:57 +00:00

mcp_classify_disabled_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_enable_flag_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_end_to_end_test.go

feat(auth): split inventory scope out of server scope

2026-05-31 15:14:41 +00:00

mcp_error_structured_test.go

fix(mcp): accept agents reporting version without v prefix and stop masking tool errors

2026-05-31 16:18:57 +00:00

mcp_kill_switch_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_method_not_allowed_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_origin_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_origin.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_ratelimit_bypass_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_ratelimit_defaults_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_ratelimit_malformed_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_ratelimit_prune_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_ratelimit.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_sdk_compat_test.go

feat(auth): split inventory scope out of server scope

2026-05-31 15:14:41 +00:00

mcp_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_tools_exec_error_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_tools_exec_timeout_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_tools_exec.go

docs(mcp): note server.exec reaps the whole process tree

2026-06-02 03:31:36 +00:00

mcp_tools_fs_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_tools_fs.go

feat(auth): split inventory scope out of server scope

2026-05-31 15:14:41 +00:00

mcp_tools_meta.go

feat(auth): split inventory scope out of server scope

2026-05-31 15:14:41 +00:00

mcp_tools_server_test.go

feat(auth): split inventory scope out of server scope

2026-05-31 15:14:41 +00:00

mcp_tools_server.go

feat(auth): split inventory scope out of server scope

2026-05-31 15:14:41 +00:00

mcp_transfer_audit_throttle_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_audit_throttle.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_cancel_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_consume_authz_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_correctness_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_data_frame_collision_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_download_finalcheck_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_failure_audit_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_gc_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_no_full_buffer_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_path_cap_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_size_guard_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_spool.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_token_hmac_test.go

fix(security): verify transfer-token HMAC and sign CSRF double-submit cookie

2026-05-31 05:48:50 +00:00

mcp_transfer_upload_args_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_zero_chunk_test.go

fix(security): harden gRPC stream WAF, MCP fs arg validation, and PAT server binding

2026-05-31 05:51:32 +00:00

mcp_transfer.go

feat(auth): split inventory scope out of server scope

2026-05-31 15:14:41 +00:00

mcp.go

fix(mcp): accept agents reporting version without v prefix and stop masking tool errors

2026-05-31 16:18:57 +00:00

nat.go

fix(security): reserve dashboard hosts from NAT and re-check DDNS profile ownership at worker time

2026-05-31 02:04:35 +00:00

notification_group.go

fix(controller): filter listing endpoints by ownership

2026-05-17 10:24:19 +08:00

notification.go

feat(notification): add option to convert metric units in request body (#1156)

2026-01-10 17:29:10 +08:00

oauth2_csrf_test.go

fix(security): verify transfer-token HMAC and sign CSRF double-submit cookie

2026-05-31 05:48:50 +00:00

oauth2_test.go

fix(oauth2): validate Host header against allowlist for callback URL

2026-06-05 02:42:28 +00:00

oauth2.go

fix(oauth2): validate Host header against allowlist for callback URL

2026-06-05 02:42:28 +00:00

pat_whitelist_view_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

permission_matrix_test.go

feat(service): replace EnableShowInService with HideForGuest

2026-06-02 03:31:36 +00:00

permissions_cover_fanout_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

permissions.go

feat(service): replace EnableShowInService with HideForGuest

2026-06-02 03:31:36 +00:00

rest_scope_test.go

feat(auth): split inventory scope out of server scope

2026-05-31 15:14:41 +00:00

scope_allof_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

scope_doc_consistency_test.go

feat(auth): split inventory scope out of server scope

2026-05-31 15:14:41 +00:00

scope_doc.go

feat(auth): split inventory scope out of server scope

2026-05-31 15:14:41 +00:00

server_group_update_pat_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

server_group_visibility_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

server_group.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

server.go

feat(auth): split inventory scope out of server scope

2026-05-31 15:14:41 +00:00

service_cache_key_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

service_dispatch_pat_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

service_list_pat_whitelist_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

service_skip_enabled_only_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

service_visibility_test.go

feat(service): replace EnableShowInService with HideForGuest

2026-06-02 03:31:36 +00:00

service.go

feat(service): replace EnableShowInService with HideForGuest

2026-06-02 03:31:36 +00:00

setting_enable_mcp_save_failure_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

setting_enable_mcp_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

setting_reserved_hosts_test.go

fix(security): reserve dashboard hosts from NAT and re-check DDNS profile ownership at worker time

2026-05-31 02:04:35 +00:00

setting.go

fix(security): reserve dashboard hosts from NAT and re-check DDNS profile ownership at worker time

2026-05-31 02:04:35 +00:00

stream_ownership_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

stream_pat_authz_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

tenant_isolation_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

terminal.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

transfer_cancel_authz_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

transfer_list_filter_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

transfer_pat_whitelist_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

transfer_retry_authz_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

transfer_retry_pat_whitelist_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

transfer.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

trigger_task_pat_scope_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

user.go

feat(jwt): server-side session table with keyId + obfuscated uid claims

2026-05-26 03:51:05 +00:00

waf.go

feat(waf): return ip in string literal (#947)

2025-01-04 20:49:14 +08:00

ws_stream_visibility_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

ws.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00