diff --git a/pkgs/by-name/cl/clash-verge-rev/0001-core-validate-bin_path-to-prevent-RCE-in-start_clash.patch b/pkgs/by-name/cl/clash-verge-rev/0001-core-validate-bin_path-to-prevent-RCE-in-start_clash.patch index 30bb329a77f2..e01ecacee782 100644 --- a/pkgs/by-name/cl/clash-verge-rev/0001-core-validate-bin_path-to-prevent-RCE-in-start_clash.patch +++ b/pkgs/by-name/cl/clash-verge-rev/0001-core-validate-bin_path-to-prevent-RCE-in-start_clash.patch @@ -1,6 +1,6 @@ -From fff6494e26edce6bf8a5b4c40d9535f820608cc3 Mon Sep 17 00:00:00 2001 -From: Moraxyc -Date: Mon, 28 Apr 2025 16:43:29 +0800 +From 3f86afc3a14474bff39573b1806046c888203096 Mon Sep 17 00:00:00 2001 +From: wxt <3264117476@qq.com> +Date: Thu, 19 Jun 2025 15:37:16 +0800 Subject: [PATCH 1/2] core: validate bin_path to prevent RCE in start_clash Add a security check in CoreManager::start_clash to ensure that the provided @@ -8,45 +8,22 @@ binary path (`bin_path`) must be located under the current executable's directory. This prevents potential remote code execution (RCE) attacks caused by arbitrary binary path injection. --- - src/service/core.rs | 21 ++++++++++++++++++--- - 1 file changed, 18 insertions(+), 3 deletions(-) + src/service/core.rs | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) diff --git a/src/service/core.rs b/src/service/core.rs -index 84407a5..51081ed 100644 +index 28e1d42..21efb26 100644 --- a/src/service/core.rs +++ b/src/service/core.rs @@ -7,6 +7,7 @@ use once_cell::sync::Lazy; use std::{ - collections::HashMap, sync::{atomic::Ordering, Arc, Mutex}, + fs::File, + env, }; + use log::{info, error}; - impl CoreManager { -@@ -227,7 +228,7 @@ impl CoreManager { - .unwrap() - .running_pid - .load(Ordering::Relaxed) as u32; -- -+ - match process::find_processes("verge-mihomo") { - Ok(pids) => { - // 直接在迭代过程中过滤和终止 -@@ -248,18 +249,32 @@ impl CoreManager { - }) - .filter(|&success| success) - .count(); -- -+ - println!("Successfully stopped {} verge-mihomo processes", kill_count); - } - Err(e) => { - eprintln!("Error finding verge-mihomo processes: {}", e); - } - } -- -+ - Ok(()) +@@ -223,6 +224,20 @@ impl CoreManager { } pub fn start_clash(&self, body: StartBody) -> Result<(), String> { @@ -64,9 +41,9 @@ index 84407a5..51081ed 100644 + )); + } + } + // 设置配置并测试 { - // Check clash & stop if needed - let is_running_clash = self + info!("设置Clash运行时配置: {:?}", body); -- 2.49.0 diff --git a/pkgs/by-name/cl/clash-verge-rev/0002-core-prevent-overwriting-existing-file-by-validating.patch b/pkgs/by-name/cl/clash-verge-rev/0002-core-prevent-overwriting-existing-file-by-validating.patch index 596809d9b828..b1acaf9c647d 100644 --- a/pkgs/by-name/cl/clash-verge-rev/0002-core-prevent-overwriting-existing-file-by-validating.patch +++ b/pkgs/by-name/cl/clash-verge-rev/0002-core-prevent-overwriting-existing-file-by-validating.patch @@ -1,6 +1,6 @@ -From b104778a608862789f2be400b9f13a92b1ec5b20 Mon Sep 17 00:00:00 2001 -From: Moraxyc -Date: Mon, 28 Apr 2025 21:38:02 +0800 +From f7b094a19a47ba515d734f65754d4e57b87239c1 Mon Sep 17 00:00:00 2001 +From: wxt <3264117476@qq.com> +Date: Thu, 19 Jun 2025 15:45:44 +0800 Subject: [PATCH 2/2] core: prevent overwriting existing file by validating its existence @@ -12,22 +12,22 @@ This enhances the security of log file handling by mitigating arbitrary file ove 1 file changed, 6 insertions(+) diff --git a/src/service/core.rs b/src/service/core.rs -index 51081ed..a2c4f82 100644 +index 21efb26..004d0f0 100644 --- a/src/service/core.rs +++ b/src/service/core.rs -@@ -275,6 +275,12 @@ impl CoreManager { - )); - } - } +@@ -123,6 +123,12 @@ impl CoreManager { + let config_file = config.config_file.as_str(); + let log_file = config.log_file.as_str(); + let args = vec!["-d", config_dir, "-f", config_file]; + { -+ let log_file = std::path::Path::new(body.log_file.as_str()); -+ if log_file.exists() { -+ return Err(format!("Log file already exists: {}", log_file.display())); ++ let log_file_2 = std::path::Path::new(log_file); ++ if log_file_2.exists() { ++ return Err(anyhow!(format!("Log file already exists: {}", log_file_2.display()))); + } + } - { - // Check clash & stop if needed - let is_running_clash = self + + info!("正在启动mihomo: {} -d {} -f {}", bin_path, config_dir, config_file); + -- 2.49.0 diff --git a/pkgs/by-name/cl/clash-verge-rev/package.nix b/pkgs/by-name/cl/clash-verge-rev/package.nix index 4dcbf111d4ff..9f4d49a57322 100644 --- a/pkgs/by-name/cl/clash-verge-rev/package.nix +++ b/pkgs/by-name/cl/clash-verge-rev/package.nix @@ -12,25 +12,25 @@ }: let pname = "clash-verge-rev"; - version = "2.2.3"; + version = "2.3.1"; src = fetchFromGitHub { owner = "clash-verge-rev"; repo = "clash-verge-rev"; tag = "v${version}"; - hash = "sha256-MJD1FWh/43pOffdWznCVPyGVXcIyqhXzmoEmyM8Tspg="; + hash = "sha256-NNP/NDC/Y4oBQftM6Z+pOFMEtdtvcIMYyY3sGwkpmrc="; }; src-service = fetchFromGitHub { owner = "clash-verge-rev"; repo = "clash-verge-service"; - rev = "ffcccc6095e052534980230f9e0ca97db2675062"; # no meaningful tags in this repo. The only way is updating manully every time. - hash = "sha256-AbUflPcuSuUigRQB0i52mfVu5sIep1vMZGVMZyznwXY="; + rev = "2b36be1417cb30ce592951cbadb1503e61c2c784"; # no meaningful tags in this repo. The only way is updating manully every time. + hash = "sha256-yTttQpWmqhgOx9wPGE01Bjp52QjTXLAfg+7+kPny+yg="; }; - service-cargo-hash = "sha256-lMOQznPlkHIMSm5nOLuGP9qJXt3CXnd+q8nCu+Xbbt8="; - pnpm-hash = "sha256-v9+1NjXo/1ogmep+4IP+9qoUR1GJz87VGeOoMzQ1Rfw="; - vendor-hash = "sha256-y3XVHi00mnuVFxSd02YBgfWuXYRVIs+e0tITXNOFRsA="; + service-cargo-hash = "sha256-HET7/Lyc0Ip1f9WMVzUWr0QFuL8YN3dgZdK0adl/rYc="; + pnpm-hash = "sha256-bhWaDP0gHJC6Mx9QFl4Ltk7y5jozt0eLtsPOWg821Yw="; + vendor-hash = "sha256-UkiPJNr5leKuffrrh8n2uhCe/QVjIb4S9heZXP7oKqw="; service = callPackage ./service.nix { inherit