fix: fix Security vulnerability

Signed-off-by: Xinwei Xiong (cubxxw) <3293172751nss@gmail.com>

.github/workflows/openimci.yml

@@ -130,14 +130,14 @@ jobs:
         sudo make install
 
   execute-scripts:
-    name: Execute OpenIM Script On ${{ matrix.os }}
+    name: Execute OpenIM script on ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
     environment:
       name: openim
     strategy:
       matrix:
         go_version: ["1.20"]
-        os: ["ubuntu-latest", "macos-latest"]
+        os: ["ubuntu-latest"]
     steps:
     - name: Checkout code
       uses: actions/checkout@v4
@@ -154,52 +154,18 @@ jobs:
         version: '3.x' # If available, use the latest major version that's compatible
         repo-token: ${{ secrets.GITHUB_TOKEN }}
 
-    # - name: Install latest Bash (macOS only)
+    - name: Docker Operations
-    #   if: runner.os == 'macOS'
-    #   run: |
-    #     /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
-    #     brew update
-    
-    #     brew install bash
-    #     brew install gnu-sed
-    
-    #     echo "/usr/local/bin" >> $GITHUB_PATH
-    #     echo "$(brew --prefix)/opt/gnu-sed/libexec/gnubin" >> $GITHUB_PATH
-    #   continue-on-error: true
-
-    - name: Set up Docker for Ubuntu
-      if: runner.os == 'Linux'
       run: |
         sudo make init
         sudo docker compose up -d
         sudo sleep 20
 
-    # - name: Set up Docker for macOS
+    - name: Module Operations
-    #   if: runner.os == 'macOS'
-    #   run: |
-    #     brew install --cask docker
-    #     open /Applications/Docker.app
-
-    #     sleep 10
-    #     docker-compose --version || brew install docker-compose
-
-    #     docker-compose up -d
-    #     sleep 20
-
-    - name: Module Operations for Ubuntu
-      if: runner.os == 'Linux'
       run: |
         sudo make tidy
         sudo make tools.verify.go-gitlint
 
-    # - name: Module Operations for macOS
+    - name: Build, Start, Check Services and Print Logs
-    #   if: runner.os == 'macOS'
-    #   run: |
-    #     make tidy
-    #     make tools.verify.go-gitlint
-
-    - name: Build, Start, Check Services and Print Logs for Ubuntu
-      if: runner.os == 'Linux'
       run: |
         sudo make init && \
         sudo make build && \
@@ -207,15 +173,6 @@ jobs:
         sudo make check || \
         (echo "An error occurred, printing logs:" && sudo cat ./_output/logs/* 2>/dev/null)
 
-    # - name: Build, Start, Check Services and Print Logs for macOS
-    #   if: runner.os == 'macOS'
-    #   run: |
-    #     make init && \
-    #     make build && \
-    #     make start && \
-    #     make check || \
-    #     (echo "An error occurred, printing logs:" && sudo cat ./_output/logs/* 2>/dev/null)
-
   openim-test-build-image:
     name: Build OpenIM Docker Image
     runs-on: ubuntu-latest

config/templates/config.yaml.template

@@ -122,14 +122,14 @@ api:
 # minio.signEndpoint is minio public network address
 object:
   enable: "minio"
-  apiURL: "http://14.155.64.202:10002"
+  apiURL: "http://172.28.0.1:10002"
   minio:
     bucket: "openim"
     endpoint: "http://172.28.0.1:10005"
     accessKeyID: "root"
     secretAccessKey: "openIM123"
     sessionToken: ''
-    signEndpoint: "http://14.155.64.202:10005"
+    signEndpoint: "http://172.28.0.1:10005"
     publicRead: false
   cos:
     bucketURL: https://temp-1252357374.cos.ap-chengdu.myqcloud.com
@@ -193,7 +193,7 @@ rpcRegisterName:
 # Whether to output in json format
 # Whether to include stack trace in logs
 log:
-  storageLocation: /data/workspaces/open-im-server/logs/
+  storageLocation: ../logs/
   rotationTime: 24
   remainRotationCount: 2
   remainLogLevel: 6

config/templates/env.template

@@ -26,11 +26,11 @@ PASSWORD=openIM123
 
 # Base URL for the application programming interface (API).
 # Default: API_URL=http://172.28.0.1:10002
-API_URL=http://14.155.64.202:10002
+API_URL=http://172.28.0.1:10002
 
 # Directory path for storing data files or related information.
 # Default: DATA_DIR=./
-DATA_DIR=/data/workspaces/open-im-server
+DATA_DIR=./
 
 # Choose the appropriate image address, the default is GITHUB image, 
 # you can choose docker hub, for Chinese users can choose Ali Cloud
@@ -210,9 +210,8 @@ API_OPENIM_PORT=10002
 # ======================================
 
 # Branch name for OpenIM chat.
-# Default: CHAT_IMAGE_VERSION=main
+# Default: CHAT_BRANCH=main
-# https://github.com/openimsdk/open-im-server/blob/main/docs/contrib/version.md
+CHAT_BRANCH=main
-CHAT_IMAGE_VERSION=main
 
 # Address or hostname for the OpenIM chat service.
 # Default: OPENIM_CHAT_ADDRESS=172.28.0.1
@@ -232,8 +231,8 @@ OPENIM_CHAT_DATA_DIR=./openim-chat/main
 # ======================================
 
 # Branch name for OpenIM server.
-# Default: SERVER_IMAGE_VERSION=main
+# Default: SERVER_BRANCH=main
-SERVER_IMAGE_VERSION=main
+SERVER_BRANCH=main
 
 # Port for the OpenIM admin API.
 # Default: OPENIM_ADMIN_API_PORT=10009

deployments/templates/env-template.yaml

@@ -210,8 +210,8 @@ API_OPENIM_PORT=${API_OPENIM_PORT}
 # ======================================
 
 # Branch name for OpenIM chat.
-# Default: CHAT_IMAGE_VERSION=main
+# Default: CHAT_BRANCH=main
-CHAT_IMAGE_VERSION=${CHAT_IMAGE_VERSION}
+CHAT_BRANCH=${CHAT_BRANCH}
 
 # Address or hostname for the OpenIM chat service.
 # Default: OPENIM_CHAT_ADDRESS=172.28.0.1
@@ -231,8 +231,8 @@ OPENIM_CHAT_DATA_DIR=${OPENIM_CHAT_DATA_DIR}
 # ======================================
 
 # Branch name for OpenIM server.
-# Default: SERVER_IMAGE_VERSION=main
+# Default: SERVER_BRANCH=main
-SERVER_IMAGE_VERSION=${SERVER_IMAGE_VERSION}
+SERVER_BRANCH=${SERVER_BRANCH}
 
 # Port for the OpenIM admin API.
 # Default: OPENIM_ADMIN_API_PORT=10009

docs/contrib/environment.md

@@ -104,18 +104,18 @@ Docker deployment offers a slightly more intricate template. Within the [openim-
 Configuration file modifications can be made by specifying corresponding environment variables, for instance:
 
 ```bash
-export CHAT_IMAGE_VERSION="main"   
+export CHAT_BRANCH="main"   
-export SERVER_IMAGE_VERSION="main" 
+export SERVER_BRANCH="main" 
 ```
 
 These variables are stored within the [`environment.sh`](https://github.com/OpenIMSDK/openim-docker/blob/main/scripts/install/environment.sh) configuration:
 
 ```bash
-readonly CHAT_IMAGE_VERSION=${CHAT_IMAGE_VERSION:-'main'}
+readonly CHAT_BRANCH=${CHAT_BRANCH:-'main'}
-readonly SERVER_IMAGE_VERSION=${SERVER_IMAGE_VERSION:-'main'}
+readonly SERVER_BRANCH=${SERVER_BRANCH:-'main'}
 ```
 
-Setting a variable, e.g., `export CHAT_IMAGE_VERSION="release-v1.3"`, will prioritize `CHAT_IMAGE_VERSION="release-v1.3"` as the variable value. Ultimately, the chosen image version is determined, and rendering is achieved through `make init` (or `./scripts/init-config.sh`).
+Setting a variable, e.g., `export CHAT_BRANCH="release-v1.3"`, will prioritize `CHAT_BRANCH="release-v1.3"` as the variable value. Ultimately, the chosen image version is determined, and rendering is achieved through `make init` (or `./scripts/init-config.sh`).
 
 > Note: Direct modifications to the `config.yaml` file are also permissible without utilizing `make init`.
 

internal/rpc/group/group.go

@@ -279,6 +279,7 @@ func (s *groupServer) CreateGroup(ctx context.Context, req *pbgroup.CreateGroupR
 			break
 		}
 	}
+	s.Notification.GroupCreatedNotification(ctx, tips)
 	if req.GroupInfo.GroupType == constant.SuperGroup {
 		go func() {
 			for _, userID := range userIDs {

pkg/common/discoveryregister/kubernetes/kubernetes.go

@@ -16,17 +16,11 @@ package kubernetes
 
 import (
 	"context"
-	"errors"
 	"fmt"
-	"os"
-	"strconv"
-	"strings"
 
 	"google.golang.org/grpc"
 
 	"github.com/OpenIMSDK/tools/discoveryregistry"
-	"github.com/OpenIMSDK/tools/log"
-	"github.com/openimsdk/open-im-server/v3/pkg/common/config"
 )
 
 // K8sDR represents the Kubernetes service discovery and registration client.
@@ -43,11 +37,7 @@ func NewK8sDiscoveryRegister() (discoveryregistry.SvcDiscoveryRegistry, error) {
 
 // Register registers a service with Kubernetes.
 func (cli *K8sDR) Register(serviceName, host string, port int, opts ...grpc.DialOption) error {
-	if serviceName != config.Config.RpcRegisterName.OpenImMessageGatewayName {
+	cli.rpcRegisterAddr = serviceName
-		cli.rpcRegisterAddr = serviceName
-	} else {
-		cli.rpcRegisterAddr = cli.getSelfHost(context.Background())
-	}
 
 	return nil
 }
@@ -75,68 +65,10 @@ func (cli *K8sDR) GetConfFromRegistry(key string) ([]byte, error) {
 	return nil, nil
 }
 
-func (cli *K8sDR) getSelfHost(ctx context.Context) string {
-	port := 88
-	instance := "openimserver"
-	selfPodName := os.Getenv("MY_POD_NAME")
-	ns := os.Getenv("MY_POD_NAMESPACE")
-	statefuleIndex := 0
-	gatewayEnds := strings.Split(config.Config.RpcRegisterName.OpenImMessageGatewayName, ":")
-	if len(gatewayEnds) != 2 {
-		log.ZError(ctx, "msggateway RpcRegisterName is error:config.Config.RpcRegisterName.OpenImMessageGatewayName", errors.New("config error"))
-	} else {
-		port, _ = strconv.Atoi(gatewayEnds[1])
-	}
-	podInfo := strings.Split(selfPodName, "-")
-	instance = podInfo[0]
-	count := len(podInfo)
-	statefuleIndex, _ = strconv.Atoi(podInfo[count-1])
-	host := fmt.Sprintf("%s-openim-msggateway-%d.%s-openim-msggateway-headless.%s.svc.cluster.local:%d", instance, statefuleIndex, instance, ns, port)
-	return host
-}
-
 // GetConns returns a list of gRPC client connections for a given service.
 func (cli *K8sDR) GetConns(ctx context.Context, serviceName string, opts ...grpc.DialOption) ([]*grpc.ClientConn, error) {
-	if serviceName != config.Config.RpcRegisterName.OpenImMessageGatewayName {
+	conn, err := grpc.DialContext(ctx, serviceName, append(cli.options, opts...)...)
-		conn, err := grpc.DialContext(ctx, serviceName, append(cli.options, opts...)...)
+	return []*grpc.ClientConn{conn}, err
-		return []*grpc.ClientConn{conn}, err
-	}
-	var ret []*grpc.ClientConn
-	gatewayHosts := cli.getMsgGatewayHost(ctx)
-	for _, host := range gatewayHosts {
-		conn, err := grpc.DialContext(ctx, host, append(cli.options, opts...)...)
-		if err != nil {
-			return nil, err
-		}
-		ret = append(ret, conn)
-	}
-	return ret, nil
-}
-
-// like openimserver-openim-msggateway-0.openimserver-openim-msggateway-headless.openim-lin.svc.cluster.local:88
-func (cli *K8sDR) getMsgGatewayHost(ctx context.Context) []string {
-	port := 88
-	instance := "openimserver"
-	selfPodName := os.Getenv("MY_POD_NAME")
-	replicas := os.Getenv("MY_MSGGATEWAY_REPLICACOUNT")
-	ns := os.Getenv("MY_POD_NAMESPACE")
-	gatewayEnds := strings.Split(config.Config.RpcRegisterName.OpenImMessageGatewayName, ":")
-	if len(gatewayEnds) != 2 {
-		log.ZError(ctx, "msggateway RpcRegisterName is error:config.Config.RpcRegisterName.OpenImMessageGatewayName", errors.New("config error"))
-	} else {
-		port, _ = strconv.Atoi(gatewayEnds[1])
-	}
-	nReplicas, _ := strconv.Atoi(replicas)
-	podInfo := strings.Split(selfPodName, "-")
-	instance = podInfo[0]
-	var ret []string
-	for i := 0; i < nReplicas; i++ {
-		host := fmt.Sprintf("%s-openim-msggateway-%d.%s-openim-msggateway-headless.%s.svc.cluster.local:%d", instance, i, instance, ns, port)
-		ret = append(ret, host)
-	}
-	log.ZInfo(ctx, "getMsgGatewayHost", "instance", instance, "selfPodName", selfPodName, "replicas", replicas, "ns", ns, "ret", ret)
-
-	return ret
 }
 
 // GetConn returns a single gRPC client connection for a given service.

scripts/check-all.sh

@@ -33,8 +33,8 @@ openim::log::info "\n# Begin to check all openim service"
 # OpenIM status
 # Elegant printing function
 print_services_and_ports() {
-    local -n service_names=$1
+    declare -g service_names=("${!1}")
-    local -n service_ports=$2
+    declare -g service_ports=("${!2}")
 
     echo "+-------------------------+----------+"
     echo "| Service Name            | Port     |"
@@ -47,6 +47,7 @@ print_services_and_ports() {
     echo "+-------------------------+----------+"
 }
 
+
 # Print out services and their ports
 print_services_and_ports OPENIM_SERVER_NAME_TARGETS OPENIM_SERVER_PORT_TARGETS
 
@@ -89,4 +90,4 @@ else
   echo "++++ Check all openim service ports successfully !"
 fi
 
-set -e
+set -e

scripts/githooks/pre-push.sh

@@ -102,7 +102,7 @@ print_color "Deleted Files: ${deleted_files}" "${BACKGROUND_GREEN}"
 if [[ ! $local_branch =~ $valid_branch_regex ]]
 then
     printError "There is something wrong with your branch name. Branch names in this project must adhere to this contract: $valid_branch_regex. 
-Your commit will be rejected. You should rename your branch to a valid name(feat/name OR fix/name) and try again."
+Your commit will be rejected. You should rename your branch to a valid name(feat/name OR bug/name) and try again."
     printError "For more on this, read on: https://gist.github.com/cubxxw/126b72104ac0b0ca484c9db09c3e5694"
     exit 1
 fi

scripts/init-config.sh

@@ -13,6 +13,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+
 # This script automatically initializes various configuration files and can generate example files.
 
 set -o errexit
@@ -168,6 +169,12 @@ process_file() {
   sleep 0.5
 }
 
+declare -A env_vars=(
+    ["OPENIM_IP"]="172.28.0.1"
+    ["DATA_DIR"]="./"
+    ["LOG_STORAGE_LOCATION"]="../logs/"
+)
+
 clean_config_files() {
   local all_templates=("${TEMPLATES[@]}" "${COPY_TEMPLATES[@]}")
   

scripts/install/environment.sh

@@ -66,8 +66,8 @@ def "ENV_FILE" ""${OPENIM_ROOT}"/scripts/install/environment.sh"
 
 ###################### Docker compose ###################
 # OPENIM AND CHAT
-def "CHAT_IMAGE_VERSION" "main"
+def "CHAT_BRANCH" "main"
-def "SERVER_IMAGE_VERSION" "main"
+def "SERVER_BRANCH" "main"
 
 # Choose the appropriate image address, the default is GITHUB image,
 # you can choose docker hub, for Chinese users can choose Ali Cloud
@@ -139,7 +139,7 @@ readonly API_OPENIM_PORT=${API_OPENIM_PORT:-'10002'}
 def "API_LISTEN_IP" "0.0.0.0" # API的监听IP
 
 ###################### openim-chat 配置信息 ######################
-def "OPENIM_CHAT_DATA_DIR" "./openim-chat/${CHAT_IMAGE_VERSION}"
+def "OPENIM_CHAT_DATA_DIR" "./openim-chat/${CHAT_BRANCH}"
 def "OPENIM_CHAT_ADDRESS" "${DOCKER_BRIDGE_GATEWAY}" # OpenIM服务地址
 def "OPENIM_CHAT_API_PORT" "10008"                   # OpenIM API端口
 def "CHAT_API_LISTEN_IP" ""                          # OpenIM API的监听IP

scripts/lib/logging.sh

@@ -20,7 +20,7 @@ OPENIM_VERBOSE="${OPENIM_VERBOSE:-5}"
 ENABLE_LOGGING="${ENABLE_LOGGING:-true}"
 
 # If OPENIM_OUTPUT is not set, set it to the default value
-if [ -z "${OPENIM_OUTPUT+x}" ]; then
+if [[ ! -v OPENIM_OUTPUT ]]; then
     OPENIM_OUTPUT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../_output" && pwd -P)"
 fi
 

scripts/lib/util.sh

@@ -302,12 +302,8 @@ openim::util::check_ports() {
     # Iterate over each given port.
     for port in "$@"; do
         # Use the `ss` command to find process information related to the given port.
-        if command -v ss > /dev/null 2>&1; then
+        local info=$(ss -ltnp | grep ":$port" || true)
-            info=$(ss -ltnp | grep ":$port" || true)
+        
-        else
-            info=$(netstat -ltnp | grep ":$port" || true)
-        fi
-
         # If there's no process information, it means the process associated with the port is not running.
         if [[ -z $info ]]; then
             not_started+=($port)
@@ -368,18 +364,6 @@ openim::util::check_ports() {
 # openim::util::check_process_names nginx mysql redis
 # The function returns a status of 1 if any of the processes is not running.
 openim::util::check_process_names() {
-    # Function to get the port of a process
-    get_port() {
-        local pid=$1
-        if command -v ss > /dev/null 2>&1; then
-            # used ss comment
-            ss -ltnp 2>/dev/null | grep $pid | awk '{print $4}' | cut -d ':' -f2
-        else
-            # used netstat comment replace ss
-            netstat -ltnp 2>/dev/null | grep $pid | awk '{print $4}' | sed 's/.*://'
-        fi
-    }
-
     # Arrays to collect details of processes
     local not_started=()
     local started=()
@@ -398,7 +382,7 @@ openim::util::check_process_names() {
             for pid in "${pids[@]}"; do
                 local command=$(ps -p $pid -o cmd=)
                 local start_time=$(ps -p $pid -o lstart=)
-                local port=$(get_port $pid)
+                local port=$(ss -ltnp 2>/dev/null | grep $pid | awk '{print $4}' | cut -d ':' -f2)
 
                 # Check if port information was found for the PID
                 if [[ -z $port ]]; then
@@ -435,7 +419,6 @@ openim::util::check_process_names() {
         return 0
     fi
 }
-
 # openim::util::check_process_names docker-pr
 
 # The `openim::util::stop_services_on_ports` function stops services running on specified ports.