ahdoawhfo/netdisk-fast-download
1
0
Fork 0
mirror of https://github.com/qaiu/netdisk-fast-download.git synced 2026-11-04 12:50:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): harden GHSA-997r Cloudreve SSRF residual paths

Browse Source 
Disable redirect following on CE/Ce4 attacker-controlled requests and stop
echoing upstream response bodies in client-facing JSON errors. Add
assertPublicHost regression coverage for the advisory PoC hosts.

Co-authored-by: qaiu <[email protected]>
This commit is contained in:
Cursor Agent
2026-07-26 12:05:16 +00:00
co-authored by qaiu
parent d1fa787bef
commit efbadde4ed
4 changed files with 56 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
parser/src/main/java/cn/qaiu/parser/PanBase.java
+2 -1
View File
@@ -382,9 +382,10 @@ public abstract class PanBase implements IPanTool, Closeable {
log.error("响应gzip解压或JSON解析失败: {}", e.getMessage());
fail("响应gzip解压或JSON解析失败: {}", e.getMessage());
} else {
// 上游响应体可能来自内网探测目标，仅写日志，避免经 HTTP 500 回传给调用方
String bodyPreview = responseBodyPreview(res);
log.error("解析失败: json格式异常: {}", bodyPreview);
fail("解析失败: json格式异常: {}", bodyPreview);
fail("解析失败: json格式异常");
}
return JsonObject.of();
}