Skip to content

Commit fd42b2f

Browse files
committed
fix(android): clamp imported socksPort to valid range 1-65535
parseProfileFromJson read socks_port from imported JSON without any bounds check, so a malformed or hostile profile could specify socks_port: 99999 (or 0, or negative) and it would flow straight into the exported config and the SOCKS5 client. Add coerceIn(1, 65535) on the import path; default remains 1080 when the field is absent. Found by ProfilesViewModelParseTest.clamps socksPort to 1_65535 range during plan 001 baseline creation.
1 parent b926ea6 commit fd42b2f

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

android/app/src/main/java/com/gooserelay/gooserelayvpn/ui/profiles/ProfilesViewModel.kt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -175,7 +175,7 @@ class ProfilesViewModel @Inject constructor(
175175
val name = root.get("name")?.asString ?: defaultName ?: "Imported"
176176
val debugTiming = root.get("debug_timing")?.asBoolean ?: false
177177
val socksHost = root.get("socks_host")?.asString ?: "127.0.0.1"
178-
val socksPort = root.get("socks_port")?.asInt ?: 1080
178+
val socksPort = root.get("socks_port")?.asInt?.coerceIn(1, 65535) ?: 1080
179179
val socksUser = root.get("socks_user")?.asString ?: ""
180180
val socksPass = root.get("socks_pass")?.asString ?: ""
181181
val googleHost = root.get("google_host")?.asString ?: "216.239.38.120"

0 commit comments

Comments
 (0)