# Fusion ## 产品介绍 Fusion 是一款轻量级自托管 RSS/Atom 阅读器，支持未读状态、书签、搜索、订阅分组、OPML 导入导出和 Fever API 客户端。 ## 主要功能 - RSS/Atom 订阅、自动发现和分组管理 - 未读状态、书签、搜索和键盘快捷键 - OPML 导入导出和 Fever API 客户端兼容 ## 访问说明 安装后通过 `http://<服务器 IP>:<端口>` 访问，并使用安装表单生成或设置的密码登录。默认仅绑定 `127.0.0.1`；远程访问应通过 1Panel 的 HTTPS 反向代理发布。 ## 数据持久化 `APP_DATA_DIR` 保存 SQLite 数据库。卸载不会删除此目录，请定期独立备份。 ## 安全与部署风险 - 本应用默认禁止抓取私网和本机地址的订阅源。确需读取内网订阅时，应先评估 SSRF 与网络边界，不要直接修改默认模板。 - 官方镜像为兼容旧数据而暂时以 root 启动；本应用面向新安装强制使用镜像内的 `100:101` 用户，并使用只读根文件系统、丢弃全部 Linux capabilities、启用 `no-new-privileges`。登录、创建分组和重启持久性已在该约束下验证。 - 固定版和本次审计的 `latest` 镜像快照在 amd64/arm64 扫描中均包含基础系统及 Go 依赖漏洞。唯一 Critical ID `CVE-2026-31789` 只影响 32 位平台，不适用于本应用支持的 amd64/arm64。镜像中的 OpenSSL、zlib 和 iconv 不被静态链接的 Fusion 主程序调用；默认健康检查也只访问本机明文 HTTP。 - `x/net/html` 用于订阅解析和 URL 重写，最终文章内容仍由浏览器端 DOMPurify 白名单净化后才渲染。QUIC、SSH 和 JWE 漏洞路径不属于默认 HTTP/password 部署流程。这些是默认路径的可达性例外，不代表镜像没有漏洞；移动 `latest` 标签解析到新镜像、入口或配置发生变化后必须重新审计。 ## Introduction Fusion is a lightweight self-hosted RSS/Atom reader with unread tracking, bookmarks, search, feed groups, OPML import/export, and Fever API compatibility. ## Features - RSS/Atom subscriptions, discovery, and group management - Unread tracking, bookmarks, search, and keyboard shortcuts - OPML import/export and Fever API client compatibility ## Usage Notes - Access Fusion at `http://:` and sign in with the password generated or set during installation. It binds to `127.0.0.1` by default; use an HTTPS reverse proxy for remote access. - `APP_DATA_DIR` stores the SQLite database. Uninstallation preserves this directory. - Private-network feed fetching is disabled by default. Enabling it changes the SSRF and network trust boundary and is outside this package's audited defaults. - The container is forced to UID/GID `100:101`, uses a read-only root filesystem, drops all Linux capabilities, and enables `no-new-privileges`. ## Security Note Fresh amd64 and arm64 scans of the fixed release and the audited `latest` image snapshot contain base-system and Go dependency findings. The only Critical ID, `CVE-2026-31789`, requires a 32-bit platform and does not apply to the supported architectures. Fusion is a static Go binary and does not call the image's OpenSSL, zlib, or iconv tooling in the default path. Feed HTML is ultimately sanitized with a DOMPurify allowlist before browser rendering; QUIC, SSH, and JWE vulnerable paths are not used by the default HTTP/password deployment. These are reachability exceptions for the audited snapshot, not claims that later images are vulnerability-free; reassess when the moving `latest` tag resolves to a new image. ## References - Project: - Stable release: - Dockerfile: - Configuration: - License: (MIT)