From 7442d8dd5876459c8404d10b176ab0806e1ea3ae Mon Sep 17 00:00:00 2001
From: ryan <ryan@arctel.net>
Date: Sun, 15 Mar 2026 19:04:50 +0800
Subject: [PATCH] =?UTF-8?q?[=E4=BF=AE=E5=A4=8D]=20=E5=A2=9E=E5=8A=A0?=
 =?UTF-8?q?=E5=AF=B9=E6=9C=AA=E7=9F=A5=E5=AD=90=E5=9F=9F=E5=90=8D=E7=9A=84?=
 =?UTF-8?q?=E8=AF=B7=E6=B1=82=E8=BF=94=E5=9B=9E404=E7=9A=84=E5=A4=84?=
 =?UTF-8?q?=E7=90=86?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 openflare_server/service/config_version.go    | 10 ++++--
 openflare_server/service/https_phase1_test.go | 31 +++++++++++++++++++
 2 files changed, 38 insertions(+), 3 deletions(-)

diff --git a/openflare_server/service/config_version.go b/openflare_server/service/config_version.go
index 37ca5c19..c0f203d9 100644
--- a/openflare_server/service/config_version.go
+++ b/openflare_server/service/config_version.go
@@ -747,17 +747,21 @@ func nextVersionNumber(now time.Time) (string, error) {
 }
 
 func renderHTTPProxyServer(domain string, originURL string, customHeaders []ProxyRouteCustomHeaderInput) string {
-	return fmt.Sprintf("server {\n    listen 80;\n    server_name %s;\n\n    location / {\n%s        proxy_pass %s;\n    }\n}\n\n", domain, renderProxyHeaderBlock(customHeaders), originURL)
+	return fmt.Sprintf("server {\n    listen 80;\n    server_name %s;\n%s\n    location / {\n%s        proxy_pass %s;\n    }\n}\n\n", domain, renderExactHostGuard(domain), renderProxyHeaderBlock(customHeaders), originURL)
 }
 
 func renderHTTPRedirectServer(domain string) string {
-	return fmt.Sprintf("server {\n    listen 80;\n    server_name %s;\n\n    return 301 https://$host$request_uri;\n}\n\n", domain)
+	return fmt.Sprintf("server {\n    listen 80;\n    server_name %s;\n%s\n    return 301 https://$host$request_uri;\n}\n\n", domain, renderExactHostGuard(domain))
 }
 
 func renderHTTPSServer(domain string, originURL string, certificateID uint, customHeaders []ProxyRouteCustomHeaderInput) string {
 	certPath := fmt.Sprintf("%s/%s", nginxCertDirPlaceholder, certificateCertFileName(certificateID))
 	keyPath := fmt.Sprintf("%s/%s", nginxCertDirPlaceholder, certificateKeyFileName(certificateID))
-	return fmt.Sprintf("server {\n    listen 443 ssl;\n    server_name %s;\n    ssl_certificate %s;\n    ssl_certificate_key %s;\n\n    location / {\n%s        proxy_pass %s;\n    }\n}\n\n", domain, certPath, keyPath, renderProxyHeaderBlock(customHeaders), originURL)
+	return fmt.Sprintf("server {\n    listen 443 ssl;\n    server_name %s;\n    ssl_certificate %s;\n    ssl_certificate_key %s;\n%s\n    location / {\n%s        proxy_pass %s;\n    }\n}\n\n", domain, certPath, keyPath, renderExactHostGuard(domain), renderProxyHeaderBlock(customHeaders), originURL)
+}
+
+func renderExactHostGuard(domain string) string {
+	return fmt.Sprintf("    if ($host != %q) {\n        return 404;\n    }\n", domain)
 }
 
 func renderProxyHeaderBlock(customHeaders []ProxyRouteCustomHeaderInput) string {
diff --git a/openflare_server/service/https_phase1_test.go b/openflare_server/service/https_phase1_test.go
index 77580b71..675f80d9 100644
--- a/openflare_server/service/https_phase1_test.go
+++ b/openflare_server/service/https_phase1_test.go
@@ -69,6 +69,9 @@ func TestCreateTLSCertificateAndRenderHTTPSConfig(t *testing.T) {
 	if !strings.Contains(result.Version.RenderedConfig, "listen 443 ssl;") {
 		t.Fatal("expected rendered config to include https server block")
 	}
+	if !strings.Contains(result.Version.RenderedConfig, `if ($host != "app.example.com") {`) {
+		t.Fatal("expected rendered config to reject unmatched host headers with 404")
+	}
 	if !strings.Contains(result.Version.RenderedConfig, "return 301 https://$host$request_uri;") {
 		t.Fatal("expected rendered config to include http redirect")
 	}
@@ -311,6 +314,34 @@ func TestPreviewAndDiffConfigVersion(t *testing.T) {
 	}
 }
 
+func TestRenderConfigRejectsUnknownSubdomainHosts(t *testing.T) {
+	setupServiceTestDB(t)
+
+	_, err := CreateProxyRoute(ProxyRouteInput{
+		Domain:    "git.arctel.net",
+		OriginURL: "http://127.0.0.1:8080",
+		Enabled:   true,
+	})
+	if err != nil {
+		t.Fatalf("CreateProxyRoute failed: %v", err)
+	}
+
+	preview, err := PreviewConfigVersion()
+	if err != nil {
+		t.Fatalf("PreviewConfigVersion failed: %v", err)
+	}
+
+	if !strings.Contains(preview.RenderedConfig, `server_name git.arctel.net;`) {
+		t.Fatal("expected rendered config to include exact server_name")
+	}
+	if !strings.Contains(preview.RenderedConfig, `if ($host != "git.arctel.net") {`) {
+		t.Fatal("expected rendered config to guard against unknown subdomain host matches")
+	}
+	if !strings.Contains(preview.RenderedConfig, "return 404;") {
+		t.Fatal("expected rendered config to return 404 when host does not exactly match route domain")
+	}
+}
+
 func TestCreateTLSCertificateRejectsInvalidPEM(t *testing.T) {
 	setupServiceTestDB(t)