Filter patterns (subscription subFilter, policy-group Filter, message
MsgFilter) accept arbitrary user input while the tested text (remarks
from subscriptions, log lines) is attacker-influenced. Regex.IsMatch
without timeout hangs on evil patterns like (a+)+$ - a malicious
subscription can freeze the UI/log pipeline on every update.
Add Utils.IsRegexMatch with a 2s timeout; fail open (match) with a log
so no node or message is silently dropped. Apply to all four call
sites.
Co-authored-by: sdhfsl <sdhfsl@users.noreply.github.com>
#9930 made the Xray TUN inbound always request ::/0 in autoSystemRoutingTable
so that IPv6 stops bypassing the tunnel. That only helps a host which actually
holds a globally routable IPv6 address. On any other host it does harm.
With IPv6 disabled the TUN device gets no IPv6 address at all, the kernel
rejects the route with EACCES and the whole inbound fails to start:
Failed to start: app/proxyman/inbound: failed to start proxy > proxy/tun:
failed to add system route ::/0 > permission denied
With IPv6 enabled but no global address the route is accepted and the host
gains an IPv6 default route it cannot use. The TUN completes the TCP handshake
locally before dialing the outbound, so IPv6 destinations start to look
reachable and get picked, and the connection then dies at the outbound instead
of failing fast (#10051).
Neither host has IPv6 traffic that could bypass the tunnel, so ::/0 buys them
nothing. Detect a global IPv6 address once while building the config context
and drop ::/0 when there is none. Link-local and unique local addresses do not
count: they never reach the IPv6 internet.
Co-authored-by: liuclare <177657698+liuclare@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
`Utils.ParseQueryString` already unescapes every value, and
`BaseFmt.GetQueryDecoded` unescaped it again. A value that still held a
valid percent sequence after the first pass decayed on the second: an
obfuscation password of `ob%41fs` is exported as `ob%2541fs` and imported
back as `obAfs`. Only well-formed sequences are affected, which is why the
damage is silent - `100%` and `66%ff` survive untouched.
The same function also split each pair on every `=`, and skipped the pair
unless exactly two halves came out. RFC 3986 lists `=` among the
sub-delimiters a query value may carry, so only the first one separates the
key from the value, and `HttpUtility.ParseQueryString` reads a query string
the same way. Splitting on all of them discarded a syntactically valid
pair: `?ech=AAj+DQAEAAAAAA==` was lost entirely, and so was a `plugin`
value in the non-canonical SIP002 spelling, since those are `;` separated
`key=value` lists.
v2rayN percent-encodes both on export, so its own links were never
affected; what changes is that the parser now follows the grammar instead
of discarding a pair it cannot split in two.
Splitting on the first `=` only, and reading the value the parser already
decoded, fixes both. `ParseQueryString` keeps decoding because
`ConfigHandler` reads its result directly.
`GetQueryDecoded` and `GetQueryValue` are now equivalent; they are left
separate to keep this change small, and can be collapsed if you prefer.
* first changes
* fix: use ItemsSource for fragment packets ComboBox so value saves correctly
* feat: add customizable packet fragmentation for Xray-core
- Add fragment settings in Core tab: Packets (dropdown), Length (range), Interval (range), MaxSplit (0-10000)
- Support both 'from-to' (e.g., 50-100) and single value (e.g., 50) formats for Length, Interval, and MaxSplit
- Validation with shortened error message: 'Invalid range format. Use from-to (e.g., 50-100).'
- UI in PopupBox (materialDesign) visible only when EnableFragment is checked
- Only Xray-core supported (Mihomo/sing-box fragment code removed)
- Localization updated for 8 languages
* fix: address 2dust review feedback
- Move FragmentPacketsOptions to Global class
- Remove default values from Fragment4RayItem model (set in ConfigHandler)
- Fix Avalonia bindings: move ItemsSource and SelectedItem to code-behind
- Update ViewModel to use Global.FragmentPacketsOptions
- Remove defaults from model properties
* Adjust ui
---------
Co-authored-by: 2dust <31833384+2dust@users.noreply.github.com>
* deps: bump ZXing.Net.Bindings.SkiaSharp from 0.16.14 to 0.16.22
Patch update to the latest stable release on the 0.16.x line. No breaking changes, no public API changes - purely internal fixes.
Verified by a full Release build of v2rayN.sln on .NET 10; no new warnings or errors are introduced.
* chore: remove NoWarn and fix .NET 10 build warnings
Removes the repository-level NoWarn suppression from Directory.Build.props and addresses the warnings that surface on top of the .NET 10 migration in #9179, keeping Debug, Release, and cross-platform publishes warning-free without suppressing warnings globally.
Changes:
- Removes <NoWarn>CA1031;CS1591;NU1507;CA1416;IDE0058;IDE0053;IDE0200</NoWarn> from Directory.Build.props.
- Annotates Windows-only APIs with [SupportedOSPlatform] and [SupportedOSPlatformGuard] so CA1416 accepts that the Windows surface is gated behind Utils.IsWindows() / Utils.IsNonWindows().
- Splits Utils.SetUnixFileMode into a cross-platform wrapper and a private [UnsupportedOSPlatform("windows")] implementation so File.SetUnixFileMode never reaches the analyzer on Windows builds.
- Adds a parameterless constructor to MessageBoxDialog so Avalonia's runtime XAML loader (AVLN3001) can instantiate the dialog.
- Moves the WPF high-DPI configuration from app.manifest to <ApplicationHighDpiMode>PerMonitorV2</ApplicationHighDpiMode> in v2rayN.csproj, fixing WFO0003.
- Adds global using System.Runtime.Versioning; to ServiceLib and v2rayN.Desktop so the platform attributes are usable project-wide.
* test: make cycle dependency tests locale-independent
Accept the localized Russian cycle dependency diagnostic in CoreConfigContextBuilderTests so the assertions pass when tests run under a Russian UI culture.
* fix: tighten Unix platform handling
Adds Linux and macOS platform guards so the analyzer can narrow calls through Utils.IsLinux() and Utils.IsMacOS().
Marks the Linux/macOS autostart and system proxy helpers with explicit platform attributes.
Updates Utils.GetSystemHosts() to read /etc/hosts on Linux and macOS while keeping the existing Windows hosts and hosts.ics merge behavior.
* Refactor AppRun script generation in packaging
* Update minimum kernel version requirement to 6.13
* Update minimum kernel version requirement to 5.14
* Revise runtime dependencies with version constraints
Updated runtime dependencies for package-rhel.sh to include version constraints and additional requirements.
* Modify package dependencies in package-debian.sh
Updated package dependencies to include libc6, fontconfig, coreutils, and bash.
* Remove AppImage packaging and upload steps
Removed AppImage packaging and upload steps from the workflow.
* Delete package-appimage.sh
* Simplify environment checks in Utils.cs
Removed checks for APPIMAGE environment variable and mount path.
* Update v2rayN.slnx
* Remove package scripts from v2rayN solution
Removed references to package-appimage.sh and pkg2appimage.yml from the solution file.
* Revert "Temporary addition to support proper use of sing-box v1.12"
This reverts commit 508eb24fc3.
* Migrating to singbox 1.11 support
* Removes unnecessary sniffer
* Migrating to singbox 1.12 support
* Adds Google cn dns rules
* Improves geoip rule handling in singbox
* add anytls support
* Simplifies local DNS address handling
* Enables dhcp interface configuration
* Fetches DNS strategy for domain resolution
* support Wireguard endpoint
Refactors Singbox config classes for dial fields
* Utils.GetFreePort() default port to be zero
* Adds Sing-box legacy DNS config support
* Adds IPv4 preference to DNS configurations
对应原dns.servers[].strategy = prefer_ipv4
* Refactors DNS address parsing
* Fixes config generation
* fix singbox endpoints proxy chain not work
* Fixes wrong field
* Removes direct clash_mode domain strategy
* Improves DNS address parsing in Singbox
DNS type, host, port, and path
* Adds properties to Rule4Sbox class
* Removes Wireguard listen port
* Support sing-box hosts
* Adds tag resolver supports
* Adds sing-box DomainStrategy support
* Deletes Duplicate Rules
* Adds anytls reality support
* Fixes
* Updates sing-box documentation link
* Updates translations
