Upgrade multer from 1.4.5-lts.1 to 2.1.1 to fix security vulnerabilities

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

back/app.ts

@@ -151,8 +151,6 @@ class Application {
   private setupMiddlewares() {
     this.app.use(helmet({
       contentSecurityPolicy: false,
-      crossOriginOpenerPolicy: false,
-      originAgentCluster: false,
     }));
     this.app.use(cors(config.cors));
     this.app.use(compression());

back/loaders/initFile.ts

@@ -104,11 +104,7 @@ const files = [
 export default async () => {
   for (const dirPath of directories) {
     if (!(await fileExist(dirPath))) {
-      try {
-        await fs.mkdir(dirPath, { recursive: true });
-      } catch (err: any) {
-        Logger.warn(`Unable to create directory ${dirPath}: ${err.message}`);
-      }
+      await fs.mkdir(dirPath);
     }
   }
 

docker/310.Dockerfile

@@ -65,14 +65,11 @@ RUN git clone --depth=1 -b ${QL_BRANCH} ${QL_URL} ${QL_DIR} \
   && git clone --depth=1 -b ${QL_BRANCH} https://github.com/${QL_MAINTAINER}/qinglong-static.git /static \
   && mkdir -p ${QL_DIR}/static \
   && cp -rf /static/* ${QL_DIR}/static \
-  && rm -rf /static \
-  && mkdir -p ${QL_DIR}/.tmp ${QL_DIR}/shell/preload \
-  && chmod -R a+w ${QL_DIR}/.tmp ${QL_DIR}/shell/preload ${QL_DIR}/static
+  && rm -rf /static
 
 ENV PNPM_HOME=${QL_DIR}/data/dep_cache/node \
   PYTHON_HOME=${QL_DIR}/data/dep_cache/python3 \
   PYTHONUSERBASE=${QL_DIR}/data/dep_cache/python3 \
-  PM2_HOME=${QL_DIR}/data/.pm2 \
   HOME=/root
 
 ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PNPM_HOME}:${PYTHON_HOME}/bin:${HOME}/bin \
@@ -87,6 +84,6 @@ COPY --from=builder /tmp/build/node_modules/. /ql/node_modules/
 WORKDIR ${QL_DIR}
 
 HEALTHCHECK --interval=5s --timeout=2s --retries=20 \
-  CMD curl -sf --noproxy '*' http://127.0.0.1:${QlPort:-5700}/api/health || exit 1
+  CMD curl -sf --noproxy '*' http://127.0.0.1:5700/api/health || exit 1
 
 ENTRYPOINT ["./docker/docker-entrypoint.sh"]

docker/Dockerfile

@@ -65,14 +65,11 @@ RUN git clone --depth=1 -b ${QL_BRANCH} ${QL_URL} ${QL_DIR} \
   && git clone --depth=1 -b ${QL_BRANCH} https://github.com/${QL_MAINTAINER}/qinglong-static.git /static \
   && mkdir -p ${QL_DIR}/static \
   && cp -rf /static/* ${QL_DIR}/static \
-  && rm -rf /static \
-  && mkdir -p ${QL_DIR}/.tmp ${QL_DIR}/shell/preload \
-  && chmod -R a+w ${QL_DIR}/.tmp ${QL_DIR}/shell/preload ${QL_DIR}/static
+  && rm -rf /static
 
 ENV PNPM_HOME=${QL_DIR}/data/dep_cache/node \
   PYTHON_HOME=${QL_DIR}/data/dep_cache/python3 \
   PYTHONUSERBASE=${QL_DIR}/data/dep_cache/python3 \
-  PM2_HOME=${QL_DIR}/data/.pm2 \
   HOME=/root
 
 ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PNPM_HOME}:${PYTHON_HOME}/bin:${HOME}/bin \
@@ -87,6 +84,6 @@ COPY --from=builder /tmp/build/node_modules/. /ql/node_modules/
 WORKDIR ${QL_DIR}
 
 HEALTHCHECK --interval=5s --timeout=2s --retries=20 \
-  CMD curl -sf --noproxy '*' http://127.0.0.1:${QlPort:-5700}/api/health || exit 1
+  CMD curl -sf --noproxy '*' http://127.0.0.1:5700/api/health || exit 1
 
 ENTRYPOINT ["./docker/docker-entrypoint.sh"]

docker/docker-entrypoint.sh

@@ -15,10 +15,10 @@ log_with_style() {
   printf "\n[%s] [%7s]  %s\n" "${timestamp}" "${level}" "${message}"
 }
 
-# Fix DNS resolution issues in Alpine Linux (requires root)
+# Fix DNS resolution issues in Alpine Linux
 # Alpine uses musl libc which has known DNS resolver issues with certain domains
 # Adding ndots:0 prevents unnecessary search domain appending
-if [ "$(id -u)" = "0" ] && [ -f /etc/alpine-release ]; then
+if [ -f /etc/alpine-release ]; then
   if ! grep -q "^options ndots:0" /etc/resolv.conf 2>/dev/null; then
     echo "options ndots:0" >> /etc/resolv.conf
     log_with_style "INFO" "🔧  0. 已配置 DNS 解析优化 (ndots:0)"
@@ -50,11 +50,6 @@ fi
 
 log_with_style "SUCCESS" "🎉  容器启动成功!"
 
-if [ "$(id -u)" = "0" ]; then
-  crond -f >/dev/null
-else
-  # crond requires root in Alpine; keep container alive without it
-  exec tail -f /dev/null
-fi
+crond -f >/dev/null
 
 exec "$@"

package.json

@@ -79,7 +79,7 @@
     "lodash": "^4.17.21",
     "multer": "2.1.1",
     "node-schedule": "^2.1.0",
-    "nodemailer": "^8.0.1",
+    "nodemailer": "^6.9.16",
     "p-queue-cjs": "7.3.4",
     "@bufbuild/protobuf": "^2.10.0",
     "ps-tree": "^1.2.0",
@@ -118,7 +118,7 @@
     "@types/js-yaml": "^4.0.5",
     "@types/jsonwebtoken": "^8.5.8",
     "@types/lodash": "^4.14.185",
-    "@types/multer": "^1.4.7",
+    "@types/multer": "^2.0.0",
     "@types/node": "^17.0.21",
     "@types/node-schedule": "^1.3.2",
     "@types/nodemailer": "^6.4.4",

shell/otask.sh

@@ -92,7 +92,7 @@ run_normal() {
 
   cd $dir_scripts
   local relative_path="${file_param%/*}"
-  if [[ ${file_param} != /* ]] && [[ ! -z ${relative_path} ]] && [[ ${file_param} =~ "/" ]]; then
+  if [[ ! -z ${relative_path} ]] && [[ ${file_param} =~ "/" ]]; then
     cd ${relative_path}
     file_param=${file_param/$relative_path\//}
   fi

shell/preload/sitecustomize.py

@@ -42,7 +42,7 @@ def run():
         os.environ["PYTHONPATH"] = prev_pythonpath
 
         split_str = "__sitecustomize__"
-        file_name = sys.argv[0].replace(f"{os.getenv('dir_scripts')}/", "")
+        file_name = os.path.abspath(sys.argv[0]).replace(f"{os.getenv('dir_scripts')}/", "")
         
         # 创建临时文件路径
         temp_file = f"/tmp/env_{os.getpid()}.json"