Skip to content

fix(security): restrict subscription page access to /{uuid}/sub, fix multi-user rendering & inject vars into wrangler.toml in CI #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ukari wants to merge 5 commits into
base: master
Choose a base branch
from
Open

fix(security): restrict subscription page access to /{uuid}/sub, fix multi-user rendering & inject vars into wrangler.toml in CI #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
30fe599
fix: remove public /sub endpoint and enforce UUID in subscription path
ukari Dec 19, 2025
3e81cf1
fix(pages): render specific subscription based on UUID in URL path
ukari Dec 19, 2025
4f2521a
ci(deploy): use GitHub vars to override wrangler.toml for UUID/PROXY_IP
ukari Dec 19, 2025
76af40f
ci(deploy): inject GitHub vars into wrangler.toml for UUID/PROXY_IP
ukari Dec 19, 2025
3278d09
remove duplicate code
ukari Dec 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion .github/workflows/deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,8 +25,17 @@ jobs:
- name: Build project
run: npm run build

- name: Inject GitHub Vars into wrangler.toml
env:
GH_UUID: ${{ vars.UUID }}
GH_PROXY_IP: ${{ vars.PROXY_IP }}
run: |
sed -i "s|UUID = \".*\"|UUID = \"$GH_UUID\"|g" wrangler.toml
sed -i "s|PROXY_IP = \".*\"|PROXY_IP = \"$GH_PROXY_IP\"|g" wrangler.toml

- name: Deploy to Cloudflare Workers
uses: cloudflare/wrangler-action@v3
with:
apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

23 changes: 8 additions & 15 deletions src/core/handler.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,25 +24,18 @@ export async function handleRequest(

// Handle regular HTTP requests
const url = new URL(request.url)

// Check for subscription requests with /sub path
if (url.pathname === '/sub') {
// Import the subscription page dynamically
const { subscriptionPage } = await import('../pages/index.ts')
return await subscriptionPage(env, request)
}


// Check for subscription requests with UUID in path
const uuids = splitAndFilter(env.UUID, ',')
for (const uuid of uuids) {
if (url.pathname.includes(uuid)) {
return new Response(generateSubscription(uuid, url), {
status: 200,
headers: {
'Content-Type': 'text/plain; charset=utf-8',
},
})
// Check for subscription requests with ${uuid}/sub path
if (url.pathname === `/${uuid}/sub`) {
// Import the subscription page dynamically
const { subscriptionPage } = await import('../pages/index.ts')
return await subscriptionPage(env, request)
}

}

// Serve main index page
Expand All @@ -51,4 +44,4 @@ export async function handleRequest(
console.error('Handler error:', err)
return await errorPage()
}
}
}
118 changes: 65 additions & 53 deletions src/pages/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -450,52 +450,7 @@ const errorPageText = `<!DOCTYPE html>
</body>
</html>`

export async function indexPage(): Promise<Response> {
return new Response(indexPageText, {
status: 200,
headers: {
'Content-Type': 'text/html; charset=utf-8',
},
})
}

export async function errorPage(): Promise<Response> {
return new Response(errorPageText, {
status: 500,
headers: {
'Content-Type': 'text/html; charset=utf-8',
},
})
}

// Subscription page with enhanced UI
export async function subscriptionPage(env: any, request: Request): Promise<Response> {
const { splitAndFilter } = await import('../utils/array.ts')
const { generateSubscription, generateVlessConfig } = await import('../services/subscription.ts')

const uuids = splitAndFilter(env.UUID || '', ',')
const url = new URL(request.url)

// Generate subscription links for each UUID
const subscriptions = uuids.map((uuid: string) => ({
uuid,
link: generateSubscription(uuid, url),
vlessJson: JSON.stringify(generateVlessConfig(uuid, url), null, 2)
}))

// Properly escape strings for HTML/JavaScript
const escapeHtml = (str: string) => {
return str.replace(/&/g, '&amp;')
.replace(/</g, '&lt;')
.replace(/>/g, '&gt;')
.replace(/"/g, '&quot;')
.replace(/'/g, '&#039;');
};

// Get the first subscription if it exists
const firstSubscription = subscriptions.length > 0 ? subscriptions[0] : null;

const subscriptionPageText = `<!DOCTYPE html>
const subscriptionPageTextMaker = subscription => `<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
Expand Down Expand Up @@ -945,21 +900,21 @@ export async function subscriptionPage(env: any, request: Request): Promise<Resp
<!-- Removed the subscription URL card as requested -->

<div class="cards-container">
${firstSubscription ? `
<div class="card" data-uuid="${firstSubscription.uuid}">
${subscription ? `
<div class="card" data-uuid="${subscription.uuid}">
<div class="card-header">
<h2 class="card-title">🦊 VLESS Configuration</h2>
<span class="card-id">${firstSubscription.uuid.substring(0, 8)}...</span>
<span class="card-id">${subscription.uuid.substring(0, 8)}...</span>
</div>

<div class="config-container">
<div style="white-space: pre-wrap; word-break: break-all;">${escapeHtml(firstSubscription.link)}</div>
<div style="white-space: pre-wrap; word-break: break-all;">${escapeHtml(subscription.link)}</div>
</div>
<div class="config-hint" style="text-align: center; margin-top: 0.5rem; font-size: 0.8rem; color: #666;">
<small>💡 On mobile devices, scroll horizontally to view the full configuration</small>
</div>
<div class="actions">
<button class="btn btn-copy" data-config="${escapeHtml(firstSubscription.link)}">
<button class="btn btn-copy" data-config="${escapeHtml(subscription.link)}">
📋 Copy VLESS
</button>
</div>
Expand Down Expand Up @@ -1049,10 +1004,67 @@ export async function subscriptionPage(env: any, request: Request): Promise<Resp
</body>
</html>`

return new Response(subscriptionPageText, {
// Properly escape strings for HTML/JavaScript
const escapeHtml = (str: string) => {
return str.replace(/&/g, '&amp;')
.replace(/</g, '&lt;')
.replace(/>/g, '&gt;')
.replace(/"/g, '&quot;')
.replace(/'/g, '&#039;');
};

export async function indexPage(): Promise<Response> {
return new Response(indexPageText, {
status: 200,
headers: {
'Content-Type': 'text/html; charset=utf-8',
},
})
}
}

export async function errorPage(): Promise<Response> {
return new Response(errorPageText, {
status: 500,
headers: {
'Content-Type': 'text/html; charset=utf-8',
},
})
}

// Subscription page with enhanced UI
export async function subscriptionPage(env: any, request: Request): Promise<Response> {
const { splitAndFilter } = await import('../utils/array.ts')
const { generateSubscription, generateVlessConfig } = await import('../services/subscription.ts')

const uuids = splitAndFilter(env.UUID || '', ',')
const url = new URL(request.url)

// Generate subscription links for each UUID
const subscriptions = uuids.map((uuid: string) => ({
uuid,
link: generateSubscription(uuid, url),
vlessJson: JSON.stringify(generateVlessConfig(uuid, url), null, 2)
}))

let targetSubscription = null;
for (const sub of subscriptions) {
if (url.pathname.includes(sub.uuid)) {
targetSubscription = sub;
break;
}
}

if (targetSubscription) {
const subscriptionPageText = subscriptionPageTextMaker(targetSubscription)

return new Response(subscriptionPageText, {
status: 200,
headers: {
'Content-Type': 'text/html; charset=utf-8',
},
})
} else {
return errorPage()
}

}