secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-28 21:17:36 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

feat(toolbox-ng): port real banner inject + /__toolbox portal reverse-proxy (ref #662)

Browse Source
This commit is contained in:
CyberMind-FR 2026-06-18 19:16:27 +02:00
parent 73795bb3c3
commit 70d35eb7f2
2 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
packages/secubox-toolbox-ng/cmd/sbxmitm/banner.go
View File

@ -121,7 +121,14 @@ func portalTargetURL(portal, pathWithQuery string) string {
// portalClient is the short-timeout HTTP client used to fetch banner assets from
// the portal. Shared (stdlib http.Client is goroutine-safe) so we don't churn
// connections per request.
var portalClient = &http.Client{Timeout: 5 * time.Second}
var portalClient = &http.Client{
Timeout: 5 * time.Second,
// Never follow redirects: the portal is a fixed loopback base, so not
// following 3xx means a misbehaving/compromised portal can't steer the
// worker into fetching an arbitrary outbound host (SSRF hygiene). The 3xx
// is relayed to the client as-is.
CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse },
}
// servePortalAsset reverse-proxies a /__toolbox/* request to the portal and
// writes the portal's response (status + Content-Type + Cache-Control + body)

10
packages/secubox-toolbox-ng/debian/changelog
View File

@ -1,3 +1,13 @@
secubox-toolbox-ng (0.1.2-1~bookworm1) bookworm; urgency=medium
* banner: port the real transparency-banner inject — inject the loader
<script src="/__toolbox/loader.js" data-mh=.. data-wg=..> (guard-idempotent,
R3 wg flag, mac_hash identity) and reverse-proxy /__toolbox/loader.js +
/__toolbox/bundle to the portal (127.0.0.1:8088), replacing the invisible
marker comment. Fail-open to 204. (ref #662)
-- Gerald KERMA <devel@cybermind.fr> Wed, 18 Jun 2026 19:20:00 +0000
secubox-toolbox-ng (0.1.1-1~bookworm1) bookworm; urgency=medium
* worker@ unit: forge with the LIVE R3 CA clients trust (mitmproxy confdir