starred/appstore
1
0
Fork 0
mirror of https://github.com/okxlin/appstore.git synced 2026-09-23 16:01:01 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
bb052dcf5eb49f0eed1a22f0f33baef663f25905
appstore/apps/lubelogger
T
History
github-action update-app-version 0068de6e35 Update app version [skip ci]
2026-08-19 20:51:21 +00:00
..
1.7.1
Update app version [skip ci]
2026-08-19 20:51:21 +00:00
data.yml
Add LubeLogger app
2026-07-28 04:08:52 +08:00
logo-LICENSE.txt
Add LubeLogger app
2026-07-28 04:08:52 +08:00
logo.png
Add LubeLogger app
2026-07-28 04:08:52 +08:00
README.md
Add LubeLogger app
2026-07-28 04:08:52 +08:00

README.md

LubeLogger

产品介绍

LubeLogger 是一个自托管的车辆管理工具，用于记录车辆保养、维修、加油、里程、提醒、升级、税费、碰撞和相关文档。

主要功能

  • 管理多辆车辆及其里程、燃油和费用记录
  • 维护保养计划、提醒和历史记录
  • 保存车辆图片、票据和其他文档
  • 支持 CSV 导入导出、报表和可选的通知集成

访问说明

安装后通过 http://<服务器 IP>:<端口> 访问，并使用安装时设置的根管理员用户名和密码登录。安装脚本只把凭据的 SHA-256 哈希传给应用，默认启用认证并关闭开放注册和邀请注册页面。

上游根用户认证使用普通 SHA-256，而不是专用密码哈希算法；必须保留 1Panel 自动生成的高强度随机密码，不要使用短密码或复用密码。LubeLogger 1.7.0 的登录接口没有请求限速，认证 Cookie 也没有显式设置 Secure、HttpOnly 或 SameSite。明文 HTTP 端口只适合可信局域网；公网访问必须使用可信 HTTPS 反向代理、阻止公网直接访问应用端口，并在代理层增加登录限速。

数据持久化

APP_DATA_DIR 挂载到 /App/data，保存 LiteDB 数据库、图片、文档、配置和会话 DataProtection 密钥。该路径必须位于应用版本目录内，默认值为 ./data；初始化脚本拒绝绝对路径、目录逃逸和认证文件符号链接，并把目录交给 UID/GID 1000:1000。卸载脚本不会删除绑定目录中的用户数据，升级或迁移前仍应单独备份。

安全与漏洞说明

  • 容器以 UID/GID 1000:1000 运行，根文件系统只读，丢弃全部 Linux capabilities，并启用 no-new-privileges；CPU、内存和进程上限由 1Panel 的应用资源设置统一管理。应用只监听内部明文 HTTP/1；TLS 应由 1Panel 或其他可信反向代理终止。可选 WebHook、OIDC、SMTP 和通知集成默认未配置，包内同时禁用 .NET HTTP 客户端的 HTTP/2 支持。
  • 对固定镜像执行的 2026-07-28 Trivy 扫描发现 0 个 Critical 和 5 个 High，均来自镜像中的 .NET 10.0.9，修复版本为 10.0.10。当前上游 v1.7.0 镜像尚未包含修复，应在上游发布使用 .NET 10.0.10 或更高版本的镜像后尽快更新。
  • CVE-2026-47302 是 XML 加密解析导致的资源耗尽。LubeLogger 源码和默认依赖路径没有使用 System.Security.Cryptography.Xml、System.Xml 或 EncryptedXml，默认部署未发现可达入口。
  • CVE-2026-50524 是畸形 TLS 握手导致的拒绝服务，CVE-2026-50528 是 SslStream 授权绕过。此包内 Kestrel 只提供 HTTP/1 明文服务，不处理入站 TLS；默认也未配置 OIDC、Webhook、SMTP 或通知等外部 TLS 集成。用户启用这些集成后应把远端视为额外风险边界。
  • CVE-2026-50651 是 .NET HTTP/2 客户端处理 SETTINGS/PING ACK flood 时可能内存耗尽。LubeLogger 有可选的出站 HTTP 客户端路径，但此包通过 DOTNET_SYSTEM_NET_HTTP_SOCKETSHTTPHANDLER_HTTP2SUPPORT=false 禁用 HTTP/2，并默认不配置相关集成。
  • CVE-2026-57108 是解析特制 X.509 证书时的类型混淆拒绝服务。默认内部 HTTP 服务不解析入站证书；打开 Sponsors 页面或启用外部 TLS 集成时会产生出站证书解析路径，因此该项不能视为完全不可达。只连接可信端点，并在修复镜像可用后立即升级。

Introduction

LubeLogger is a self-hosted vehicle management application for tracking maintenance, repairs, fuel, mileage, reminders, upgrades, taxes, collisions, and related documents.

Features

  • Manage multiple vehicles and their mileage, fuel, and cost records
  • Track maintenance plans, reminders, and service history
  • Store vehicle images, receipts, and other documents
  • Import and export CSV data, generate reports, and configure optional notifications

Access And Authentication

Access the service at http://<server-ip>:<port> and sign in with the root username and password selected during installation. The initialization script passes only SHA-256 credential hashes to the application. Authentication is enabled by default, while open registration and the invitation registration page are disabled.

Upstream root authentication uses plain SHA-256 rather than a password-specific KDF. Keep the high-entropy password generated by 1Panel; do not use a short or reused password. LubeLogger 1.7.0 does not rate-limit login requests, and its authentication cookie does not explicitly set Secure, HttpOnly, or SameSite. Direct plain-HTTP access is suitable only on a trusted LAN. For public access, use a trusted HTTPS reverse proxy, block public access to the application port, and add login rate limiting at the proxy.

Data Persistence

APP_DATA_DIR is mounted at /App/data and stores the LiteDB database, images, documents, configuration, and DataProtection session keys. It must remain inside the application version directory and defaults to ./data. The initializer rejects absolute paths, directory escapes, and a symlinked authentication file, then assigns the directory to UID/GID 1000:1000. Uninstall does not remove bind-mounted user data; back it up before upgrades or migration.

Security And Vulnerability Notes

  • The container runs as UID/GID 1000:1000, uses a read-only root filesystem, drops all Linux capabilities, and enables no-new-privileges. CPU, memory, and process limits are managed through 1Panel's application resource settings. The application serves internal plain HTTP/1 only; terminate TLS at 1Panel or another trusted reverse proxy. Optional webhook, OIDC, SMTP, and notification integrations are not configured, and .NET HTTP client HTTP/2 support is disabled.
  • A 2026-07-28 Trivy scan of the pinned image found 0 Critical and 5 High findings, all in .NET 10.0.9. The fixes are in .NET 10.0.10. Upstream v1.7.0 has not yet published an image with those fixes; update promptly when it does.
  • CVE-2026-47302 is an XML-encryption parsing resource-exhaustion issue. LubeLogger source and default dependencies do not use System.Security.Cryptography.Xml, System.Xml, or EncryptedXml, so no default reachable entry point was found.
  • CVE-2026-50524 is a malformed TLS-handshake denial of service, and CVE-2026-50528 is an SslStream authorization bypass. Kestrel serves only internal plain HTTP/1 in this package and does not process inbound TLS. OIDC, webhook, SMTP, and notification integrations are also unconfigured by default. Enabling them adds a separate outbound TLS risk boundary.
  • CVE-2026-50651 is an HTTP/2 client SETTINGS/PING ACK flood that may cause an out-of-memory condition. LubeLogger has optional outbound HTTP client paths, but this package sets DOTNET_SYSTEM_NET_HTTP_SOCKETSHTTPHANDLER_HTTP2SUPPORT=false and leaves those integrations unconfigured.
  • CVE-2026-57108 is a type-confusion denial of service while parsing a crafted X.509 certificate. The internal HTTP service does not parse inbound certificates. Opening the Sponsors view or enabling outbound TLS integrations does create certificate-parsing paths, so this finding is not considered completely unreachable. Connect only to trusted endpoints and upgrade as soon as a fixed image is available.

References

Reference in New Issue View Git Blame Copy Permalink