fix: fix security issue in snippets精简版pipe上行 - 缓存发送.js

[anupamme]

Summary

Fix high severity security issue in proxy/snippets精简版pipe上行 - 缓存发送.js.

Vulnerability

Field	Value
ID	V-003
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-003
File	proxy/snippets精简版pipe上行 - 缓存发送.js:276
Assessment	Likely exploitable

Description: Multiple proxy protocol handlers extract payload data using chunk.subarray() with offset values parsed from untrusted network input. No validation ensures dataOffset is within chunk bounds, allowing attackers to manipulate protocol packets and cause out-of-bounds access, protocol confusion, or unexpected behavior in the JavaScript runtime.

Evidence

Exploitation scenario: Attacker crafts malformed VLESS/Trojan/Shadowsocks protocol packets with manipulated dataOffset values exceeding chunk length.

Scanner confirmation: multi_agent_ai rule V-003 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Changes

• proxy/snippets精简版pipe上行 - 缓存发送.js

Behavior Preservation

The change is scoped to 1 file on the vulnerable path.

---

Automated security fix by OrbisAI Security