clash-verge-rev: 2.2.3 -> 2.3.1

pkgs/by-name/cl/clash-verge-rev/0001-core-validate-bin_path-to-prevent-RCE-in-start_clash.patch

@@ -1,6 +1,6 @@
-From fff6494e26edce6bf8a5b4c40d9535f820608cc3 Mon Sep 17 00:00:00 2001
-From: Moraxyc <i@qaq.li>
-Date: Mon, 28 Apr 2025 16:43:29 +0800
+From 3f86afc3a14474bff39573b1806046c888203096 Mon Sep 17 00:00:00 2001
+From: wxt <3264117476@qq.com>
+Date: Thu, 19 Jun 2025 15:37:16 +0800
 Subject: [PATCH 1/2] core: validate bin_path to prevent RCE in start_clash
 
 Add a security check in CoreManager::start_clash to ensure that the provided
@@ -8,45 +8,22 @@ binary path (`bin_path`) must be located under the current executable's
 directory. This prevents potential remote code execution (RCE) attacks
 caused by arbitrary binary path injection.
 ---
- src/service/core.rs | 21 ++++++++++++++++++---
- 1 file changed, 18 insertions(+), 3 deletions(-)
+ src/service/core.rs | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
 
 diff --git a/src/service/core.rs b/src/service/core.rs
-index 84407a5..51081ed 100644
+index 28e1d42..21efb26 100644
 --- a/src/service/core.rs
 +++ b/src/service/core.rs
 @@ -7,6 +7,7 @@ use once_cell::sync::Lazy;
  use std::{
-     collections::HashMap,
      sync::{atomic::Ordering, Arc, Mutex},
+     fs::File,
 +    env,
  };
+ use log::{info, error};
  
- impl CoreManager {
-@@ -227,7 +228,7 @@ impl CoreManager {
-             .unwrap()
-             .running_pid
-             .load(Ordering::Relaxed) as u32;
--        
-+
-         match process::find_processes("verge-mihomo") {
-             Ok(pids) => {
-                 // 直接在迭代过程中过滤和终止
-@@ -248,18 +249,32 @@ impl CoreManager {
-                     })
-                     .filter(|&success| success)
-                     .count();
--                    
-+
-                 println!("Successfully stopped {} verge-mihomo processes", kill_count);
-             }
-             Err(e) => {
-                 eprintln!("Error finding verge-mihomo processes: {}", e);
-             }
-         }
--        
-+
-         Ok(())
+@@ -223,6 +224,20 @@ impl CoreManager {
      }
  
      pub fn start_clash(&self, body: StartBody) -> Result<(), String> {
@@ -64,9 +41,9 @@ index 84407a5..51081ed 100644
 +                ));
 +            }
 +        }
+         // 设置配置并测试
          {
-             // Check clash & stop if needed
-             let is_running_clash = self
+             info!("设置Clash运行时配置: {:?}", body);
 -- 
 2.49.0
 

pkgs/by-name/cl/clash-verge-rev/0002-core-prevent-overwriting-existing-file-by-validating.patch

@@ -1,6 +1,6 @@
-From b104778a608862789f2be400b9f13a92b1ec5b20 Mon Sep 17 00:00:00 2001
-From: Moraxyc <i@qaq.li>
-Date: Mon, 28 Apr 2025 21:38:02 +0800
+From f7b094a19a47ba515d734f65754d4e57b87239c1 Mon Sep 17 00:00:00 2001
+From: wxt <3264117476@qq.com>
+Date: Thu, 19 Jun 2025 15:45:44 +0800
 Subject: [PATCH 2/2] core: prevent overwriting existing file by validating its
  existence
 
@@ -12,22 +12,22 @@ This enhances the security of log file handling by mitigating arbitrary file ove
  1 file changed, 6 insertions(+)
 
 diff --git a/src/service/core.rs b/src/service/core.rs
-index 51081ed..a2c4f82 100644
+index 21efb26..004d0f0 100644
 --- a/src/service/core.rs
 +++ b/src/service/core.rs
-@@ -275,6 +275,12 @@ impl CoreManager {
-                 ));
-             }
-         }
+@@ -123,6 +123,12 @@ impl CoreManager {
+         let config_file = config.config_file.as_str();
+         let log_file = config.log_file.as_str();
+         let args = vec!["-d", config_dir, "-f", config_file];
 +        {
-+            let log_file = std::path::Path::new(body.log_file.as_str());
-+            if log_file.exists() {
-+                return Err(format!("Log file already exists: {}", log_file.display()));
++            let log_file_2 = std::path::Path::new(log_file);
++            if log_file_2.exists() {
++                return Err(anyhow!(format!("Log file already exists: {}", log_file_2.display())));
 +            }
 +        }
-         {
-             // Check clash & stop if needed
-             let is_running_clash = self
+ 
+         info!("正在启动mihomo: {} -d {} -f {}", bin_path, config_dir, config_file);
+ 
 -- 
 2.49.0
 

pkgs/by-name/cl/clash-verge-rev/package.nix

@@ -12,25 +12,25 @@
 }:
 let
   pname = "clash-verge-rev";
-  version = "2.2.3";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "clash-verge-rev";
     repo = "clash-verge-rev";
     tag = "v${version}";
-    hash = "sha256-MJD1FWh/43pOffdWznCVPyGVXcIyqhXzmoEmyM8Tspg=";
+    hash = "sha256-NNP/NDC/Y4oBQftM6Z+pOFMEtdtvcIMYyY3sGwkpmrc=";
   };
 
   src-service = fetchFromGitHub {
     owner = "clash-verge-rev";
     repo = "clash-verge-service";
-    rev = "ffcccc6095e052534980230f9e0ca97db2675062"; # no meaningful tags in this repo. The only way is updating manully every time.
-    hash = "sha256-AbUflPcuSuUigRQB0i52mfVu5sIep1vMZGVMZyznwXY=";
+    rev = "2b36be1417cb30ce592951cbadb1503e61c2c784"; # no meaningful tags in this repo. The only way is updating manully every time.
+    hash = "sha256-yTttQpWmqhgOx9wPGE01Bjp52QjTXLAfg+7+kPny+yg=";
   };
 
-  service-cargo-hash = "sha256-lMOQznPlkHIMSm5nOLuGP9qJXt3CXnd+q8nCu+Xbbt8=";
-  pnpm-hash = "sha256-v9+1NjXo/1ogmep+4IP+9qoUR1GJz87VGeOoMzQ1Rfw=";
-  vendor-hash = "sha256-y3XVHi00mnuVFxSd02YBgfWuXYRVIs+e0tITXNOFRsA=";
+  service-cargo-hash = "sha256-HET7/Lyc0Ip1f9WMVzUWr0QFuL8YN3dgZdK0adl/rYc=";
+  pnpm-hash = "sha256-bhWaDP0gHJC6Mx9QFl4Ltk7y5jozt0eLtsPOWg821Yw=";
+  vendor-hash = "sha256-UkiPJNr5leKuffrrh8n2uhCe/QVjIb4S9heZXP7oKqw=";
 
   service = callPackage ./service.nix {
     inherit