mirror of
https://hubproxy.babadafafafafa.cn/https://github.com/mihomo-party-org/clash-party.git
synced 2026-09-20 08:03:39 +08:00
588aaa6991
convertMrsRuleset built a shell command string from `behavior` and the resolved ruleset path and ran it through `exec`. `behavior` comes from the runtime config's `rule-providers`, which originates from the user's subscription YAML and is therefore untrusted input. A malicious or compromised subscription can set a behavior such as `domain & <command> &`; opening that ruleset in the resource viewer then executes arbitrary commands with the app's privileges. The quoted paths are also breakable on Windows via an embedded double quote. Switch to `execFile` with an argument array so nothing is parsed by a shell, and reject any behavior outside the set the core supports. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Another Mihomo GUI
本项目认证稳定机场推荐：“狗狗加速”
狗狗加速 —— 技术流机场 Doggygo VPN
- 高性能海外机场，稳定首选，海外团队，无跑路风险
- Clash Party专属8折优惠码：party，仅有500份
- Party专属链接注册送 3 天，每天 1G 流量 免费试用
- 优惠套餐每月仅需 15.8 元，160G 流量，年付 8 折
- 全球首家支持Hysteria1/2 协议，集群负载均衡设计，高速专线，基于最新UDP quic技术，极低延迟，无视晚高峰，4K 秒开，配合Clash Party食用更省心！
- 解锁流媒体及 ChatGPT
- 官网：https://狗狗加速.com
特性
- 一键 Smart Core 规则覆写，基于 AI 模型自动选择最优节点 详细介绍请看 这里
- 开箱即用，无需服务模式的 Tun
- 多种配色主题可选，UI 焕然一新
- 支持大部分 Mihomo(Clash Meta) 常用配置修改
- 内置 Smart内核 与 Mihomo(Clash Meta) 内核
- 通过 WebDAV 一键备份和恢复配置
- 强大的覆写功能，任意修订配置文件
- 深度集成 Sub-Store，轻松管理订阅