{"record":{"id":"d8bc078e1518abc3","repo":"MHSanaei/3x-ui","slug":"download-xray-checksum-w","errorCode":null,"errorMessage":"download xray checksum: %w","messagePattern":"download xray checksum: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/web/service/server.go","lineNumber":953,"sourceCode":"\t}\n\tif got := hex.EncodeToString(hasher.Sum(nil)); !strings.EqualFold(got, want) {\n\t\t// User-facing warning: the archive's SHA-256 does not match the official\n\t\t// release checksum, so the download is corrupted or has been tampered\n\t\t// with. Abort the install so a bad binary is never run, and tell the user\n\t\t// to retry/re-download rather than proceed with a mismatched image.\n\t\treturn \"\", fmt.Errorf(\"Xray update aborted: the downloaded archive does not match the official SHA-256 checksum, so the image is corrupted or differs from the official release. Please exit and re-download the official image, then try again (expected %s, got %s)\", want, got)\n\t}\n\n\tok = true\n\treturn path, nil\n}\n\n// fetchXrayDigestSHA256 downloads the .dgst sidecar XTLS publishes next to each\n// release asset and returns the SHA2-256 hex digest it lists.\nfunc (s *ServerService) fetchXrayDigestSHA256(client *http.Client, dgstURL string) (string, error) {\n\treq, reqErr := http.NewRequestWithContext(context.Background(), http.MethodGet, dgstURL, nil)\n\tif reqErr != nil {\n\t\treturn \"\", fmt.Errorf(\"download xray checksum: %w\", reqErr)\n\t}\n\tresp, err := client.Do(req)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"download xray checksum: %w\", err)\n\t}\n\tdefer resp.Body.Close()\n\tif resp.StatusCode != http.StatusOK {\n\t\treturn \"\", fmt.Errorf(\"download xray checksum: unexpected HTTP %d\", resp.StatusCode)\n\t}\n\traw, err := io.ReadAll(io.LimitReader(resp.Body, maxXrayDigestBytes))\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"download xray checksum: %w\", err)\n\t}\n\treturn parseXrayDigestSHA256(raw)\n}\n\n// parseXrayDigestSHA256 extracts the lowercase SHA2-256 hex from an XTLS .dgst\n// file, whose lines are \"ALGO= <hex>\" (the relevant one being \"SHA2-256= ...\").","sourceCodeStart":935,"sourceCodeEnd":971,"githubUrl":"https://github.com/MHSanaei/3x-ui/blob/ad32144c42455696ea9f14e12168beac3e25f5d2/internal/web/service/server.go#L935-L971","documentation":"Returned by fetchXrayDigestSHA256 when http.NewRequestWithContext rejects the .dgst URL before any request is sent (%w wraps reqErr). The URL is mechanically built as the asset URL + \".dgst\", so failure here means the constructed URL is not parseable — practically only possible when the base asset URL was already malformed or contains illegal characters. On success paths this error is unreachable.","triggerScenarios":"A version string with control characters or spaces slotted into the URL template; a corrupted base URL from upstream configuration; test harnesses injecting invalid URLs.","commonSituations":"Almost never seen in production; appears in tests or when version input is not sanitized before UpdateXray.","solutions":["Inspect the exact version string passed to UpdateXray for whitespace/control characters","Pre-validate versions against the release list (the code already does via slices.Contains) before manual calls","Treat this error as a code smell: log the URL being built when it fires"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if _, err := url.ParseRequestURI(dgstURL); err != nil {\n    return fmt.Errorf(\"refusing to fetch malformed digest URL %q: %w\", dgstURL, err)\n}\n","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Sanitize version inputs (allowlist ^v?\\d+\\.\\d+\\.\\d+$ style) before building URLs","Gate versions against the fetched release list before constructing download URLs"],"tags":["xray-update","url","validation"],"backgroundTag":null,"analyzedSha":"ad32144c42455696ea9f14e12168beac3e25f5d2","analyzedAt":"2026-08-15T11:13:23.905Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}