mescon/Muximux v3.3.2

on GitHub

Closes a path-traversal bypass, fixes two layout bugs from 3.3.1, and adds
an escape hatch for backends that sit behind a strict reverse proxy.
Release artifacts now carry signed provenance. Drop-in, but worth taking
promptly if you use auth_bypass on a proxied app.

Added

• forwarded_headers on apps. Set it to false when a proxied backend
  is fronted by a reverse proxy that only trusts X-Forwarded-* from
  specific sources. Traefik and nginx answer 400 Bad Request in that
  situation, which made such a backend impossible to embed at all. The
  option already existed for gateway sites; it now covers the embedding
  proxy too, on both the HTTP and WebSocket paths. Defaults to true, so
  nothing changes unless you set it.

• Clicking a group marker in a flat top or bottom bar now scrolls that
  group's apps into view. Flat mode has no collapsible sections, so the
  markers were previously decorative.

• Release artifacts now carry signed build provenance and an SBOM. Every
  published binary and the container image are attested to the workflow,
  commit and runner that produced them, and an SPDX SBOM ships as a release
  asset. Verify a download without trusting the registry:

  gh attestation verify muximux-linux-amd64 --repo mescon/Muximux
  gh attestation verify oci://ghcr.io/mescon/muximux:3.3.2 --repo mescon/Muximux
  

Changed

• The app catalog now lists Seerr, the project Overseerr and Jellyseerr
  are merging into, and Docker discovery recognises the seerr/seerr and
  ghcr.io/seerr/seerr images. The linuxserver/overseerr and
  fallenbagel/jellyseerr mappings are unchanged and still report their own
  names -- those tags remain the pre-merge projects.
• Screenshots throughout the README and wiki have been retaken, and the
  mobile view is now documented.

Security

• Rejected percent-encoded path traversal. http.ServeMux compares the
  escaped path when deciding whether to redirect, so ..%2f reached the
  handler with r.URL.Path already decoded to contain ../. Auth bypass
  rules are prefix-matched against that value and the proxy joins it onto
  the app's base path, so an encoded traversal could satisfy an
  auth_bypass rule for /api/* and still reach a backend path outside
  /api. Requests whose decoded path contains a . or .. segment are now
  refused with 400 before authentication runs. Found by a new fuzz target.
• Added fuzz coverage for the content rewriter, script rewriter, identity
  header expansion and backend path join -- the parts of the proxy that
  consume bytes Muximux does not control.
• Added ID token rejection tests for issuer, audience, expiry, signature,
  alg=none and nonce, none of which were previously asserted.

Fixed

• Dashboard tiles were sized to their labels. A tile for "Home
  Assistant" came out wider than one for "Pi-hole", so the overview grid was
  visibly ragged and rows failed to line up. Tiles now fill their grid cell.
• The log viewer's message column collapsed to one character wide,
  rendering "HTTP request" vertically down the page, one letter per line.
  Any entry carrying a wide attribute list triggered it, which is most HTTP
  entries.
• The mobile navigation button honours floating_position; the wiki
  incorrectly stated it was always bottom-right.