From 8351e49ed6c19bf359ae17c8841fe0ba19d8f0e6 Mon Sep 17 00:00:00 2001
From: Meo597 <197331664+Meo597@users.noreply.github.com>
Date: Mon, 26 Oct 2026 09:05:07 +0800
Subject: [PATCH] limit the file ext for downloads

---
 infra/conf/geodata.go      |  5 +++++
 infra/conf/geodata_test.go | 33 +++++++++++++++++++++++++++++++++
 2 files changed, 38 insertions(+)

diff --git a/infra/conf/geodata.go b/infra/conf/geodata.go
index 3e80967ac..f79a37e23 100644
--- a/infra/conf/geodata.go
+++ b/infra/conf/geodata.go
@@ -2,6 +2,8 @@ package conf
 
 import (
 	"net/url"
+	"path/filepath"
+	"strings"
 
 	"github.com/robfig/cron/v3"
 	"github.com/xtls/xray-core/app/geodata"
@@ -19,6 +21,9 @@ func (c *GeodataAssetConfig) Build() (*geodata.Asset, error) {
 	if err := validateHTTPS(c.URL); err != nil {
 		return nil, errors.New("invalid geodata asset url: ", c.URL).Base(err)
 	}
+	if !strings.EqualFold(filepath.Ext(c.File), ".dat") {
+		return nil, errors.New("geodata asset file extension must be .dat")
+	}
 	if _, err := filesystem.StatAsset(c.File); err != nil {
 		return nil, errors.New("invalid geodata asset file: ", c.File).Base(err)
 	}
diff --git a/infra/conf/geodata_test.go b/infra/conf/geodata_test.go
index d75d04527..4944d850a 100644
--- a/infra/conf/geodata_test.go
+++ b/infra/conf/geodata_test.go
@@ -1,7 +1,9 @@
 package conf_test
 
 import (
+	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
 	"github.com/xtls/xray-core/app/geodata"
@@ -73,3 +75,34 @@ func TestGeodataAssetConfigInvalidURL(t *testing.T) {
 		}
 	}
 }
+
+func TestGeodataAssetConfigFileExtension(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("xray.location.asset", dir)
+	for _, tc := range []struct {
+		name  string
+		valid bool
+	}{
+		{"custom.dat", true},
+		{"custom.DAT", true},
+		{"launcher.cmd", false},
+		{"script.lua", false},
+		{"config.json", false},
+		{"asset", false},
+	} {
+		if err := os.WriteFile(filepath.Join(dir, tc.name), nil, 0o600); err != nil {
+			t.Fatal(err)
+		}
+		_, err := (&GeodataAssetConfig{
+			URL:  "https://example.com/download",
+			File: tc.name,
+		}).Build()
+		if tc.valid {
+			if err != nil {
+				t.Fatalf("Build(%q): %v", tc.name, err)
+			}
+		} else if err == nil || !strings.Contains(err.Error(), "extension must be .dat") {
+			t.Fatalf("Build(%q) = %v; want .dat extension error", tc.name, err)
+		}
+	}
+}