Repository navigation
fix(fmt): decode the SIP002 plain-text password only once - #10520
Merged
Merged
Conversation
For a SIP002 link whose user info is "method:password" rather than base64 (the 2022-blake3 form), ResolveSip002 unescapes the whole user info and then unescapes the password a second time. A password that still holds a valid percent sequence after the first pass decays: p%41ss is written as p%2541ss and imported as pAss. Same double-decoding as 2dust#10027 fixed for query values. Co-Authored-By: Claude Opus 5.5 <[email protected]>
patterniha
added a commit
to patterniha/PattN
that referenced
this pull request
Nov 11, 2026
Brings in 2dust/v2rayN up to e3457fa (still 7.25.6): - Native AOT (2dust#10295, 2dust#10513): JSON through a source-generated context, trimming roots, and AOT zips of the Windows desktop, Linux and macOS builds; ReactiveUI 26 (2dust#10249) and ProDataGrid (2dust#10347); - a pre-resolver per subscription (2dust#10220), MASQUE WARP (2dust#10498), the XDRIVE transport (2dust#10546), sing-box TUN dns_mode (2dust#10336) and an AUTO bind interface (2dust#10519); - the download refactor with Downloader 6 (2dust#10534), subscription profiles kept on a failed import (2dust#10429), repeated test results kept (2dust#10466), share-link fixes (2dust#10504, 2dust#10505, 2dust#10520, 2dust#10526), udphop (2dust#10550), REALITY fragments (2dust#10428), and the WebAPI's restart deadline (2dust#10516) and macOS instance lock (2dust#10454); - Linux packages cross-built for x64, arm64, riscv64, ppc64le and loong64 in one job, plus x86 packages (2dust#10487, 2dust#10537), and a daily certificate update workflow (2dust#10497). Where upstream changed code PattN had changed: - no IPv6 FakeIP setting (2dust#10464): PattN writes no fakedns block, so Xray-core uses its default IPv4 and IPv6 pools, and sing-box gets an IPv6 range on its own; FakeIPUtils and its tests go; - 2dust#10485's DNS change is not taken: PattN asks each direct group's servers in turn and ends the query on the last; - the TUN inbound copies the inbound's sniffing (2dust#10460) without forcing routeOnly; - MASQUE: upstream's editor and import, which no longer clear or lock the TLS options: the fork core speaks HTTP/2 over TLS when the ALPN has h2 but not h3, so they apply there; - the WebAPI restart: upstream's polling fix (2dust#10516) replaces PattN's own wait. Adapted to the AOT JSON and the download refactor: Aether's DNS, the share-link JSON options, the outbound tag check and the Psiphon test fixtures go through the source-generated context; the Aether test only says whether to measure speed, and its IP lookup uses a download service on the tunnel's proxy; the rule-set 404 skip moves into the new download helper. Release workflows and Linux packaging scripts take upstream's layout with PattN's names and bundles: every Linux architecture builds on each release (exotic_arch is gone; patterniha/Aether has builds for x64 and arm64 only), the deb packages keep the cores' execute bits (2dust#10335), which 2dust#10537's rewrite dropped, and the certificate workflow runs only upstream. Conflicts: - resx: both sets of strings. - SubEditWindow: upstream's pre-resolver row among PattN's rows. - AddServerViewModelTests: upstream's; PattN's preset tests move to AddServerViewModelPresetTests. - CoreConfigV2rayIPNetworkTests: without upstream's fakedns pool test. - README: PattN's.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
For a SIP002 link whose user info is
method:passwordinstead of base64 (the form the 2022-blake3 ciphers use), the user info is percent-encoded once.ResolveSip002unescapes the whole user info and then unescapes the password a second time, so a password that still holds a valid percent sequence after the first pass decays:This is the same double decoding that #10027 fixed for query values. The change drops the second
UrlDecode. The first one stays, so an encoded:in the user info still splits as before.ShadowsocksFmtTestschecksp%2541ss,p%25ssanda%3Ab%2Fc%2B%3D. The first fails without the change (pAss) and all pass with it, and so does the rest ofServiceLib.Tests(179 tests).I used Claude Code to write this change.