From 386379fc837f536b528430790ea1b0633f426978 Mon Sep 17 00:00:00 2001 From: Ivan Razin Date: Tue, 21 Jul 2026 08:37:22 +0300 Subject: [PATCH] fix(installer): anchor and validate tag_name parsing for latest release Greedy sed captured the last quoted string on the matched line, not necessarily the tag_name value, and no validation caught a malformed result before it was used to build the download URL. --- x-ui-latest.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/x-ui-latest.sh b/x-ui-latest.sh index d548b56..457cce9 100644 --- a/x-ui-latest.sh +++ b/x-ui-latest.sh @@ -742,12 +742,12 @@ install_panel() { fi else tag_version=$(curl -Ls "https://api.github.com/repos/MHSanaei/3x-ui/releases/latest" \ - | grep '"tag_name":' | sed -E 's/.*"([^"]+)".*/\1/') - if [[ -z "$tag_version" ]]; then + | grep -m1 '"tag_name":' | sed -E 's/.*"tag_name": *"([^"]+)".*/\1/') + if [[ ! "$tag_version" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then tag_version=$(curl -4 -Ls "https://api.github.com/repos/MHSanaei/3x-ui/releases/latest" \ - | grep '"tag_name":' | sed -E 's/.*"([^"]+)".*/\1/') + | grep -m1 '"tag_name":' | sed -E 's/.*"tag_name": *"([^"]+)".*/\1/') fi - if [[ -z "$tag_version" ]]; then + if [[ ! "$tag_version" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then echo "Failed to fetch 3x-ui version." && exit 1 fi fi