fix(sub): serve a copy-only page when a subscription URL is opened in a browser - #6183
Open
n0ctal wants to merge 2 commits into
Open
fix(sub): serve a copy-only page when a subscription URL is opened in a browser#6183n0ctal wants to merge 2 commits into
n0ctal wants to merge 2 commits into
Conversation
Browser navigation to /sub previously rendered the normal subscription page, which exposed subscription material in page data or raw base64 depending on request headers. Keep VPN clients on the raw subscription body, but classify browser document requests and return a neutral static copy-only HTML page with no embedded share links or page data. This preserves the C1 LimitIP parser fix in the same master candidate while avoiding a DE rollback of the browser subscription UX.
Only implicit browser navigation is downgraded to the copy-only page. An operator who appends html=1 or view=html already holds the URL, so the themed subscription page keeps rendering for them and serveSubPage stays in use.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Serve a copy-only page, instead of the full subscription page, when a subscription URL is opened by a browser, and widen browser detection beyond the
Acceptheader.Why
maybeServeSubPagerenders the normal subscription page for any request that looks like a browser. That page embeds the share links in its page data — the actual configs, inline in the HTML.Subscription URLs travel. They get pasted into chats, forwarded to a second device, opened to "check if it still works". Anything that fetches the URL with an HTML-ish
Acceptheader renders the page and receives every config on it: a messenger unfurling a link preview, a corporate proxy prefetching, a browser extension, a shared-screen moment. None of that requires the recipient to intend anything — the configs are simply in the response body.Detection was also narrower than the traffic it has to classify. It keyed on
Accept: text/html,?html=1and?view=htmlonly, so a browser navigation that did not advertise HTML fell through to the raw subscription body.Scope
maybeServeSubPagestill validates the subscription, but rendersserveSubscriptionCopyPage— a page that lets the user copy the subscription URL without embedding the config payload.isBrowserSubscriptionRequestadds two further signals:Sec-Fetch-Dest: document/Sec-Fetch-Mode: navigate, which browsers send on real navigations regardless ofAccept.Mozilla/User-Agent check, with an explicit allowlist for VPN clients that also send aMozilla/prefix (clash, mihomo, sing-box, v2ray, xray, hiddify, nekobox, shadowrocket, streisand, v2box and others) so importing clients keep receiving the raw body.Validation
go build ./internal/...clean.go test ./internal/sub/green onmainatece16559with this applied, including the new browser-detection cases.mainwithout conflict.Risk
Low for clients, moderate for anyone who relied on the browser page to read configs directly — that is the behaviour being removed on purpose. The client allowlist is the one place to review: a client not on it that sends
Mozilla/and does not identify itself would now get the copy page instead of the body. Happy to extend the list with any client you know of.