fix: 加固安全输入边界并修复订阅兼容性 (#3084)

* fix: harden scoped API inputs and isolate login throttling

* fix: close script path gaps and harden security boundaries

* fix: preserve subscription aliases and avoid extension eval

* fix: allow cancelling invalid historical subscriptions

* fix: make script parent validation explicit for CodeQL

* fix: limit command execution and clarify trusted path branches

* fix: separate diff tool script access from config APIs

* fix: clean up obsolete subscription SSH credentials

back/api/config.ts

@@ -72,14 +72,13 @@ export default (app: Router) => {
       const logger: Logger = Container.get('logger');
       try {
         const { name, content } = req.body;
-        // Resolve path first to prevent traversal attacks
-        const scriptFile = name.startsWith('data/scripts/');
-        const basePath = scriptFile ? config.scriptPath : config.configPath;
-        const cleanName = name.replace(/^data\/scripts\//, '');
+        if (name.startsWith('data/scripts/')) {
+          return res.send({ code: 403, message: t('文件无法访问') });
+        }
         const normalized = resolveFileAccess(
-          basePath,
-          [cleanName],
-          scriptFile ? [] : config.blackFileList,
+          config.configPath,
+          [name],
+          config.blackFileList,
         );
         if (!normalized) {
           return res.send({ code: 403, message: t('文件无法访问') });