Feature Request: Add API Support for Editing/Updating YAML Configs, Proxy Providers, and Rule Providers

[Medium1992]

Hello!

I would like to propose adding functionality to the API that allows editing and replacing YAML configuration files, as well as proxy provider and rule-provider files located inside the Mihomo container (in the working directory).

The purpose of this request is to enable the development of full-featured web panels with visual configuration for Mihomo. I experimented with a simple file-server–style API in Go, and it worked perfectly for modifying configs inside the container.

This is just a basic example, but if Mihomo natively included such API capabilities, it could open a new era of web-based panels for the project. It might even inspire the creation of server-side management panels similar to 3x-ui, but powered by Mihomo — which would be amazing for the community.

I hope this idea will be positively considered.

Below is a small mihomo-file-api.go example I used:

package main

import (
	"flag"
	"fmt"
	"io"
	"net/http"
	"os"
	"os/exec"
	"path/filepath"
	"strings"
)

var (
	port      = flag.String("p", "3001", "HTTP port")
	configDir = flag.String("d", "/root/.config/mihomo", "Config directory")
	mihomoBin = flag.String("b", "mihomo", "mihomo binary name/path")
)

func main() {
	flag.Parse()
	tmpDir := filepath.Join(*configDir, "tmp")
	os.MkdirAll(tmpDir, 0755)

	http.HandleFunc("/files", listHandler)
	http.HandleFunc("/files/", fileHandler) // GET / PUT / DELETE
	http.ListenAndServe(":"+*port, nil)
}

// GET /files
func listHandler(w http.ResponseWriter, r *http.Request) {
	if r.Method != "GET" {
		http.Error(w, "GET only", 405)
		return
	}
	entries, _ := os.ReadDir(*configDir)
	var files []string
	for _, e := range entries {
		name := e.Name()
		if !e.IsDir() && (strings.HasSuffix(name, ".yaml") || strings.HasSuffix(name, ".yml")) {
			files = append(files, name)
		}
	}
	fmt.Fprintf(w, `{"files":%q}`, files)
}

// GET / PUT / DELETE /files/config.yaml
func fileHandler(w http.ResponseWriter, r *http.Request) {
	name := strings.TrimPrefix(r.URL.Path, "/files/")
	if name == "" || strings.Contains(name, "/") || strings.Contains(name, "..") {
		http.Error(w, "bad name", 400)
		return
	}
	if !strings.HasSuffix(name, ".yaml") && !strings.HasSuffix(name, ".yml") {
		http.Error(w, "only yaml", 400)
		return
	}

	mainPath := filepath.Join(*configDir, name)
	tmpPath := filepath.Join(*configDir, "tmp", name)

	switch r.Method {

	case "GET":
		data, err := os.ReadFile(mainPath)
		if err != nil {
			http.Error(w, "not found", 404)
			return
		}
		w.Header().Set("Content-Type", "text/yaml")
		w.Write(data)

	case "PUT":
		os.MkdirAll(filepath.Dir(tmpPath), 0755)
		tmpFile, err := os.Create(tmpPath)
		if err != nil {
			http.Error(w, "tmp create error", 500)
			return
		}
		io.Copy(tmpFile, r.Body)
		tmpFile.Close()

		cmd := exec.Command(*mihomoBin, "-t", "-f", tmpPath)
		out, err := cmd.CombinedOutput()
		if err != nil {
			os.Remove(tmpPath) 
			w.Header().Set("Content-Type", "application/json")
			fmt.Fprintf(w, `{"valid":false,"error":%q}`, string(out))
			return
		}

		data, _ := os.ReadFile(tmpPath)
		os.WriteFile(mainPath, data, 0644)
		os.Remove(tmpPath)
		w.Write([]byte("saved"))

	case "DELETE":
		if strings.HasPrefix(name, "tmp/") {
			http.Error(w, "cannot delete tmp", 403)
			return
		}
		if err := os.Remove(mainPath); err != nil {
			http.Error(w, "delete failed", 500)
			return
		}
		w.Write([]byte("deleted"))

	default:
		http.Error(w, "GET/PUT/DELETE only", 405)
	}
}

With the binary startup command:

./mihomo-file-api -p 3001 -d /root/.config/mihomo -b /mihomo

[wwqgtxx]

First, we must acknowledge that this functionality itself is valuable.

However, it's crucial to recognize that providing the ability to view, modify, and replace local files via a RESTful API is extremely dangerous.

Many users may not have properly configured their API secrets or may be using weak passwords. If this functionality is provided by the kernel, it creates a massive attack surface (currently, there are numerous exploits that use the RESTful API to modify the external-ui-url to maliciously overwrite other local files).

The APIs provided by helper wrappers from many downstream projects also have similar security vulnerabilities.

Until a sufficiently robust solution is found to address these security issues, this proposal will not be considered.

[Medium1992]

Thank you for responding to the proposal.
I fully agree regarding the safety aspect — it is of utmost importance.
In my view, your comments will require quite a few changes. However, at the very least for ensuring security, we can remove the API-related access parameters from the YAML configuration file and pass them as command-line arguments when launching the service, or as environment variables in containerized environments.
Enabling file overwriting via the API can also be controlled through a command-line flag or an environment variable in the container, which would allow or prohibit this functionality — and of course it should be disabled by default.