fatedier/frp
The highest-risk areas are command-execution token sources (gated behind the TokenSourceExec unsafe feature), filesystem-serving and socket-exposing client plugins (static_file, unix_domain_socket which can expose docker.sock), the VirtualNet TUN setup that shells out to ifconfig/route on macOS, and admin web servers that depend on auth middleware correctness. Concurrency risk concentrates in server/control.go's ControlManager, which enforces a documented lock order (runMu -> cm.mu -> lifecycleMu -> registry) and generation handoff barriers; regressions there cause deadlocks or leaked controls. The deprecated INI path (pkg/config/legacy) and the testing-only --config_dir mode are legacy surface. Plugin content mutation uses a deliberate panic on wrong types.
- ExecSource.Resolve executes arbitrary commands (exec.CommandContext with env passthrough) to produce auth tokens; it is gated by the TokenSourceExec entry in both ClientUnsafeFeatures and ServerUnsafeFeatures requiring --allow-unsafe.
- VirtualNet setup on Darwin shells out to ifconfig and route to configure the TUN device; tun_linux.go uses netlink. Errors here are runtime-privilege dependent.
- unix_domain_socket and static_file client plugins expose local filesystem paths/sockets remotely; README documents exposing /var/run/docker.sock as a TCP proxy, an intentionally dangerous capability.
- Admin APIs (client /api/config PUT, /api/stop, /api/store/*; server DELETE /api/proxies, /api/v2/system/prune) are powerful mutation endpoints guarded only by helper.AuthMiddleware on the dashboard port — misconfiguration of webServer auth exposes full control. (inferred)
- ControlManager implements a strict multi-lock protocol (never wait on runMu holding cm.mu; order runMu -> cm.mu -> ctl.lifecycleMu -> registry locks) with generation IDs and handoff barriers; the complexity concentrates deadlock/race risk in control.go.
- GetWorkConn recovers from panics and the worker teardown closes pooled conns, but a full workConnCh silently discards registered work conns ('work connection pool is full, discarding').
- Plugin content mutation in handleMutableContent does retContent.(*T) with a comment 'Buggy Plugin implementations still panic here, by design' — a malicious/broken server plugin path can panic the handler goroutine.
- Server plugins make outbound HTTP calls to user-configured addresses during login/proxy/workconn events; a plugin failure rejects the operation (errors fail closed for mutable ops like Login/NewProxy).
- Legacy INI support is deprecated and routed through pkg/config/legacy converters; conf/legacy holds reference INI files. New features are TOML/YAML/JSON-only, so the legacy path is dead-end code that still runs when a 'common' section is detected.
- xtcp relies on public STUN (default stun.easyvoip.com:3478) and NAT-behavior heuristics in nathole; P2P may silently fail on incompatible NATs — README itself recommends stcp fallback.
- SSH tunnel gateway accepts native SSH connections on a dedicated port and pipes them into the control plane (InternalListener); it expands the server's attack surface to the SSH protocol. (inferred)
- Duplicate proxy/visitor names across merged config sources are rejected at load by validateNoDuplicateNames; before this check a duplicate would have been silently dropped — indicates historically fragile merge semantics. (inferred)
- frpc tlsListener sniffs first bytes to distinguish frp TLS from HTTPS; misclassification risk exists when vhostHTTPS shares the bind port (comment notes 0x16 ambiguity). (inferred)