MHSanaei 33b029e1ca fix(security): confine GetCertHash to known cert files (CWE-22) ... Resolve CodeQL go/path-injection (alert #96): the certFile path from the getCertHash endpoint flowed straight into os.ReadFile, letting an authenticated request read arbitrary files by path. Validate it against an allow-list of certificate files the panel already references (inbound TLS certificateFile values plus the panel's own web cert) and read the config-sourced path rather than the caller-supplied one, breaking the taint flow while preserving arbitrary cert locations.		2026-06-21 17:56:17 +02:00
..
config	Test-quality audit: fix 2 prod bugs, strengthen weak tests, add mutation/fuzz/CI tooling (#5345)	2026-06-15 15:17:03 +02:00
database	feat(tls,reality): port xray TLS/REALITY fields, cert-hash helpers, fallback UX	2026-06-21 15:58:42 +02:00
eventbus	feat(memory): add memory threshold alerts (#5366)	2026-06-21 17:45:33 +02:00
logger	refactor(frontend): move form-item hints from extra to tooltip	2026-06-17 17:24:16 +02:00
mtproto	refactor(frontend): move form-item hints from extra to tooltip	2026-06-17 17:24:16 +02:00
sub	feat(tls,reality): port xray TLS/REALITY fields, cert-hash helpers, fallback UX	2026-06-21 15:58:42 +02:00
util	fix(sub): SS2022 share links must not base64-encode userinfo (#5432)	2026-06-20 11:25:12 +02:00
web	fix(security): confine GetCertHash to known cert files (CWE-22)	2026-06-21 17:56:17 +02:00
xray	fix(xray): guard log-writer race and bound handler gRPC deadlines (#5442)	2026-06-20 18:10:18 +02:00