Skip to content

fix: sanitize DNS inputs and guard AWG s3/s4 #31

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
hawkff wants to merge 2 commits into from
Closed

fix: sanitize DNS inputs and guard AWG s3/s4 #31

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
483089f
fix: sanitize DNS inputs and guard AWG s3 s4
hawkff Jun 19, 2026
5f073d1
fix: reject sanitized DNS fallback safely
hawkff Jun 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions app/src/main/java/io/nekohasekai/sagernet/fmt/ConfigBuilder.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,10 @@ import moe.matsuri.nb4a.utils.Util
import moe.matsuri.nb4a.utils.listByLineOrComma
import okhttp3.HttpUrl.Companion.toHttpUrlOrNull

private fun sanitizeDnsEntry(value: String): String {
return value.filterNot { it.isISOControl() }.trim()
}

const val TAG_MIXED = "mixed-in"

const val TAG_PROXY = "proxy"
Expand Down Expand Up @@ -144,9 +148,9 @@ fun buildConfig(
val isVPN = DataStore.serviceMode == Key.MODE_VPN
val bind = if (!forTest && DataStore.allowAccess) "0.0.0.0" else LOCALHOST
val remoteDns = DataStore.remoteDns.split("\n")
.mapNotNull { dns -> dns.trim().takeIf { it.isNotBlank() && !it.startsWith("#") } }
.mapNotNull { dns -> sanitizeDnsEntry(dns).takeIf { it.isNotBlank() && !it.startsWith("#") } }
val directDNS = DataStore.directDns.split("\n")
.mapNotNull { dns -> dns.trim().takeIf { it.isNotBlank() && !it.startsWith("#") } }
.mapNotNull { dns -> sanitizeDnsEntry(dns).takeIf { it.isNotBlank() && !it.startsWith("#") } }
val enableDnsRouting = DataStore.enableDnsRouting
val useFakeDns = DataStore.enableFakeDns && !forTest
val needSniff = DataStore.trafficSniffing > 0
Expand Down
5 changes: 3 additions & 2 deletions app/src/main/java/io/nekohasekai/sagernet/fmt/amneziawg/AmneziaWGFmt.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,9 @@ fun buildSingBoxOutboundAmneziaWGBean(bean: AmneziaWGBean): SingBoxOptions.Outbo
if (bean.jmax != 0) jmax = bean.jmax
if (bean.s1 != 0) s1 = bean.s1
if (bean.s2 != 0) s2 = bean.s2
if (bean.s3 != 0) s3 = bean.s3
if (bean.s4 != 0) s4 = bean.s4
// The bundled amneziawg-go v1.0.4 UAPI does not accept s3/s4 yet.
// Keep these fields importable/storable, but do not emit them until
// the core supports the corresponding device keys.
Comment thread
greptile-apps[bot] marked this conversation as resolved.
if (bean.h1.isNotBlank()) h1 = bean.h1
if (bean.h2.isNotBlank()) h2 = bean.h2
if (bean.h3.isNotBlank()) h3 = bean.h3
Expand Down
28 changes: 26 additions & 2 deletions app/src/main/java/io/nekohasekai/sagernet/ui/SettingsPreferenceFragment.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,26 @@ class SettingsPreferenceFragment : PreferenceFragmentCompat() {
true
}

private fun sanitizeDnsPreferenceValue(value: String): String {
return value.lines().joinToString("\n") { line ->
line.filterNot { it.isISOControl() }.trim()
}
}

private fun dnsReloadListener(preference: Preference, newValue: Any?): Boolean {
val rawValue = newValue as? String ?: return reloadListener.onPreferenceChange(preference, newValue)
val sanitizedValue = sanitizeDnsPreferenceValue(rawValue)
if (sanitizedValue != rawValue) {
if (preference is EditTextPreference) {
preference.text = sanitizedValue
}
needReload()
return false
}
needReload()
return true
Comment thread
greptile-apps[bot] marked this conversation as resolved.
}

override fun onCreatePreferences(savedInstanceState: Bundle?, rootKey: String?) {
preferenceManager.preferenceDataStore = DataStore.configurationStore
DataStore.initGlobal()
Expand Down Expand Up @@ -203,8 +223,12 @@ class SettingsPreferenceFragment : PreferenceFragmentCompat() {
concurrentDial.onPreferenceChangeListener = reloadListener

enableFakeDns.onPreferenceChangeListener = reloadListener
remoteDns.onPreferenceChangeListener = reloadListener
directDns.onPreferenceChangeListener = reloadListener
remoteDns.onPreferenceChangeListener = Preference.OnPreferenceChangeListener { preference, newValue ->
dnsReloadListener(preference, newValue)
}
directDns.onPreferenceChangeListener = Preference.OnPreferenceChangeListener { preference, newValue ->
dnsReloadListener(preference, newValue)
}
enableDnsRouting.onPreferenceChangeListener = reloadListener

ipv6Mode.onPreferenceChangeListener = reloadListener
Expand Down
Loading