fix: support non-root user container startup

- Guard /etc/resolv.conf write and crond behind root check in entrypoint;
  non-root containers now stay alive via 'tail -f /dev/null' instead of
  failing when crond exits with EPERM
- Set PM2_HOME to ${QL_DIR}/data/.pm2 (inside the data volume) so PM2
  does not fall back to /root/.pm2, which is inaccessible to non-root users
- Pre-create /ql/.tmp and /ql/shell/preload during image build and make
  them world-writable so non-root processes can write runtime files
- Wrap directory creation in initFile.ts with try/catch + recursive:true
  so a permission error on ~/.ssh (HOME=/root for non-root user) is logged
  as a warning instead of crashing the server init

back/app.ts

@@ -151,6 +151,8 @@ class Application {
   private setupMiddlewares() {
     this.app.use(helmet({
       contentSecurityPolicy: false,
+      crossOriginOpenerPolicy: false,
+      originAgentCluster: false,
     }));
     this.app.use(cors(config.cors));
     this.app.use(compression());

back/config/util.ts

@@ -10,7 +10,6 @@ import Logger from '../loaders/logger';
 import { writeFileWithLock } from '../shared/utils';
 import { DependenceTypes } from '../data/dependence';
 import { FormData } from 'undici';
-import os from 'os';
 
 export * from './share';
 
@@ -591,162 +590,3 @@ export function getUninstallCommand(
 export function isDemoEnv() {
   return process.env.DeployEnv === 'demo';
 }
-
-// OS detection for Linux mirror configuration
-let osType: 'Debian' | 'Ubuntu' | 'Alpine' | undefined;
-
-async function getOSReleaseInfo(): Promise<string> {
-  try {
-    const osRelease = await fs.readFile('/etc/os-release', 'utf8');
-    return osRelease;
-  } catch (error) {
-    Logger.error(`Failed to read /etc/os-release: ${error}`);
-    return '';
-  }
-}
-
-function isDebian(osReleaseInfo: string): boolean {
-  return osReleaseInfo.includes('Debian');
-}
-
-function isUbuntu(osReleaseInfo: string): boolean {
-  return osReleaseInfo.includes('Ubuntu');
-}
-
-function isAlpine(osReleaseInfo: string): boolean {
-  return osReleaseInfo.includes('Alpine');
-}
-
-export async function detectOS(): Promise<
-  'Debian' | 'Ubuntu' | 'Alpine' | undefined
-> {
-  if (osType) return osType;
-  const platform = os.platform();
-
-  if (platform === 'linux') {
-    const osReleaseInfo = await getOSReleaseInfo();
-    // Check Ubuntu before Debian since Ubuntu is based on Debian
-    if (isUbuntu(osReleaseInfo)) {
-      osType = 'Ubuntu';
-    } else if (isDebian(osReleaseInfo)) {
-      osType = 'Debian';
-    } else if (isAlpine(osReleaseInfo)) {
-      osType = 'Alpine';
-    } else {
-      Logger.error(`Unknown Linux Distribution: ${osReleaseInfo}`);
-      console.error(`Unknown Linux Distribution: ${osReleaseInfo}`);
-    }
-  } else if (platform === 'darwin') {
-    osType = undefined;
-  } else {
-    Logger.error(`Unsupported platform: ${platform}`);
-    console.error(`Unsupported platform: ${platform}`);
-  }
-
-  return osType;
-}
-
-async function getCurrentMirrorDomain(
-  filePath: string,
-): Promise<string | null> {
-  try {
-    const fileContent = await fs.readFile(filePath, 'utf8');
-    const lines = fileContent.split('\n');
-    for (const line of lines) {
-      if (line.trim().startsWith('#')) {
-        continue;
-      }
-      const match = line.match(/https?:\/\/[^\/]+/);
-      if (match) {
-        return match[0];
-      }
-    }
-    return null;
-  } catch (error) {
-    Logger.error(`Failed to read mirror configuration file ${filePath}: ${error}`);
-    return null;
-  }
-}
-
-function escapeRegExp(string: string): string {
-  return string.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
-
-async function replaceDomainInFile(
-  filePath: string,
-  oldDomainWithScheme: string,
-  newDomainWithScheme: string,
-): Promise<void> {
-  // Ensure the new domain has a trailing slash before replacement
-  if (!newDomainWithScheme.endsWith('/')) {
-    newDomainWithScheme += '/';
-  }
-
-  let fileContent = await fs.readFile(filePath, 'utf8');
-  // Escape special regex characters in the old domain
-  const escapedOldDomain = escapeRegExp(oldDomainWithScheme);
-  let updatedContent = fileContent.replace(
-    new RegExp(escapedOldDomain, 'g'),
-    newDomainWithScheme,
-  );
-
-  await writeFileWithLock(filePath, updatedContent);
-}
-
-async function _updateLinuxMirror(
-  osType: string,
-  mirrorDomainWithScheme: string,
-): Promise<string> {
-  let filePath: string, currentDomainWithScheme: string | null;
-  switch (osType) {
-    case 'Debian':
-      filePath = '/etc/apt/sources.list.d/debian.sources';
-      currentDomainWithScheme = await getCurrentMirrorDomain(filePath);
-      if (currentDomainWithScheme) {
-        await replaceDomainInFile(
-          filePath,
-          currentDomainWithScheme,
-          mirrorDomainWithScheme || 'http://deb.debian.org',
-        );
-        return 'apt-get update';
-      } else {
-        throw Error(`Current mirror domain not found.`);
-      }
-    case 'Ubuntu':
-      filePath = '/etc/apt/sources.list.d/ubuntu.sources';
-      currentDomainWithScheme = await getCurrentMirrorDomain(filePath);
-      if (currentDomainWithScheme) {
-        await replaceDomainInFile(
-          filePath,
-          currentDomainWithScheme,
-          mirrorDomainWithScheme || 'http://archive.ubuntu.com',
-        );
-        return 'apt-get update';
-      } else {
-        throw Error(`Current mirror domain not found.`);
-      }
-    case 'Alpine':
-      filePath = '/etc/apk/repositories';
-      currentDomainWithScheme = await getCurrentMirrorDomain(filePath);
-      if (currentDomainWithScheme) {
-        await replaceDomainInFile(
-          filePath,
-          currentDomainWithScheme,
-          mirrorDomainWithScheme || 'http://dl-cdn.alpinelinux.org',
-        );
-        return 'apk update';
-      } else {
-        throw Error(`Current mirror domain not found.`);
-      }
-    default:
-      throw Error('Unsupported OS type for updating mirrors.');
-  }
-}
-
-export async function updateLinuxMirrorFile(mirror: string): Promise<string> {
-  const detectedOS = await detectOS();
-  if (!detectedOS) {
-    throw Error(`Unknown Linux Distribution`);
-  }
-  return await _updateLinuxMirror(detectedOS, mirror);
-}

back/loaders/express.ts

@@ -13,9 +13,29 @@ import { isValidToken } from '../shared/auth';
 import path from 'path';
 
 export default ({ app }: { app: Application }) => {
+  // Security: Enable strict routing to prevent case-insensitive path bypass
+  app.set('case sensitive routing', true);
+  app.set('strict routing', true);
   app.set('trust proxy', 'loopback');
   app.use(cors());
   
+  // Security: Path normalization middleware to prevent case variation attacks
+  app.use((req, res, next) => {
+    const originalPath = req.path;
+    const normalizedPath = originalPath.toLowerCase();
+    
+    // Block requests with case variations on protected paths
+    if (originalPath !== normalizedPath && 
+        (normalizedPath.startsWith('/api/') || normalizedPath.startsWith('/open/'))) {
+      return res.status(400).json({
+        code: 400,
+        message: 'Invalid path format'
+      });
+    }
+    
+    next();
+  });
+  
   // Rewrite URLs to strip baseUrl prefix if configured
   // This allows the rest of the app to work without baseUrl awareness
   if (config.baseUrl) {
@@ -36,7 +56,7 @@ export default ({ app }: { app: Application }) => {
       secret: config.jwt.secret,
       algorithms: ['HS384'],
     }).unless({
-      path: [...config.apiWhiteList, /^\/(?!api\/).*/],
+      path: [...config.apiWhiteList, /^(\/(?!api\/).*)$/i],
     }),
   );
 
@@ -51,19 +71,20 @@ export default ({ app }: { app: Application }) => {
   });
 
   app.use(async (req: Request, res, next) => {
-    if (!['/open/', '/api/'].some((x) => req.path.startsWith(x))) {
+    const pathLower = req.path.toLowerCase();
+    if (!['/open/', '/api/'].some((x) => pathLower.startsWith(x))) {
       return next();
     }
 
     const headerToken = getToken(req);
-    if (req.path.startsWith('/open/')) {
+    if (pathLower.startsWith('/open/')) {
       const apps = await shareStore.getApps();
       const doc = apps?.filter((x) =>
         x.tokens?.find((y) => y.value === headerToken),
       )?.[0];
       if (doc && doc.tokens && doc.tokens.length > 0) {
         const currentToken = doc.tokens.find((x) => x.value === headerToken);
-        const keyMatch = req.path.match(/\/open\/([a-z]+)\/*/);
+        const keyMatch = pathLower.match(/\/open\/([a-z]+)\/*/);
         const key = keyMatch && keyMatch[1];
         if (
           doc.scopes.includes(key as any) &&
@@ -98,7 +119,15 @@ export default ({ app }: { app: Application }) => {
   });
 
   app.use(async (req, res, next) => {
-    if (!['/api/user/init', '/api/user/notification/init'].includes(req.path)) {
+    const pathLower = req.path.toLowerCase();
+    if (
+      ![
+        '/api/user/init',
+        '/api/user/notification/init',
+        '/open/user/init',
+        '/open/user/notification/init',
+      ].includes(req.path)
+    ) {
       return next();
     }
     const authInfo =

back/loaders/initData.ts

@@ -13,7 +13,7 @@ import { AuthDataType, SystemModel } from '../data/system';
 import SystemService from '../services/system';
 import UserService from '../services/user';
 import { writeFile, readFile } from 'fs/promises';
-import { createRandomString, fileExist, safeJSONParse } from '../config/util';
+import { createRandomString, fileExist, isDemoEnv, safeJSONParse } from '../config/util';
 import OpenService from '../services/open';
 import { shareStore } from '../shared/store';
 import Logger from './logger';
@@ -50,7 +50,7 @@ export default async () => {
   const [authConfig] = await SystemModel.findOrCreate({
     where: { type: AuthDataType.authConfig },
   });
-  if (!authConfig?.info) {
+  if (!authConfig?.info || isDemoEnv()) {
     let authInfo = {
       username: 'admin',
       password: 'admin',

back/loaders/initFile.ts

@@ -104,7 +104,11 @@ const files = [
 export default async () => {
   for (const dirPath of directories) {
     if (!(await fileExist(dirPath))) {
-      await fs.mkdir(dirPath);
+      try {
+        await fs.mkdir(dirPath, { recursive: true });
+      } catch (err: any) {
+        Logger.warn(`Unable to create directory ${dirPath}: ${err.message}`);
+      }
     }
   }
 

back/services/system.ts

@@ -17,7 +17,6 @@ import {
   readDirs,
   rmPath,
   setSystemTimezone,
-  updateLinuxMirrorFile,
 } from '../config/util';
 import {
   DependenceModel,
@@ -215,11 +214,33 @@ export default class SystemService {
     onEnd?: () => void,
   ) {
     const oDoc = await this.getSystemConfig();
+    await this.updateAuthDb({
+      ...oDoc,
+      info: { ...oDoc.info, ...info },
+    });
+    let defaultDomain = 'https://dl-cdn.alpinelinux.org';
+    let targetDomain = 'https://dl-cdn.alpinelinux.org';
     if (os.platform() !== 'linux') {
       return;
     }
-    const command = await updateLinuxMirrorFile(info.linuxMirror || '');
+    const content = await fs.promises.readFile('/etc/apk/repositories', {
-    let hasError = false;
+      encoding: 'utf-8',
+    });
+    const domainMatch = content.match(/(http.*)\/alpine\/.*/);
+    if (domainMatch) {
+      defaultDomain = domainMatch[1];
+    }
+    if (info.linuxMirror) {
+      targetDomain = info.linuxMirror;
+    }
+    const command = `sed -i 's/${defaultDomain.replace(
+      /\//g,
+      '\\/',
+    )}/${targetDomain.replace(
+      /\//g,
+      '\\/',
+    )}/g' /etc/apk/repositories && apk update -f`;
+
     this.scheduleService.runTask(
       command,
       {
@@ -233,15 +254,8 @@ export default class SystemService {
             message: 'update linux mirror end',
           });
           onEnd?.();
-          if (!hasError) {
-            await this.updateAuthDb({
-              ...oDoc,
-              info: { ...oDoc.info, ...info },
-            });
-          }
         },
         onError: async (message: string) => {
-          hasError = true;
           this.sockService.sendMessage({ type: 'updateLinuxMirror', message });
         },
         onLog: async (message: string) => {

docker/310.Dockerfile

@@ -65,13 +65,17 @@ RUN git clone --depth=1 -b ${QL_BRANCH} ${QL_URL} ${QL_DIR} \
   && git clone --depth=1 -b ${QL_BRANCH} https://github.com/${QL_MAINTAINER}/qinglong-static.git /static \
   && mkdir -p ${QL_DIR}/static \
   && cp -rf /static/* ${QL_DIR}/static \
-  && rm -rf /static
+  && rm -rf /static \
+  && mkdir -p ${QL_DIR}/.tmp ${QL_DIR}/shell/preload \
+  && chmod -R a+w ${QL_DIR}/.tmp ${QL_DIR}/shell/preload ${QL_DIR}/static
 
 ENV PNPM_HOME=${QL_DIR}/data/dep_cache/node \
   PYTHON_HOME=${QL_DIR}/data/dep_cache/python3 \
-  PYTHONUSERBASE=${QL_DIR}/data/dep_cache/python3
+  PYTHONUSERBASE=${QL_DIR}/data/dep_cache/python3 \
+  PM2_HOME=${QL_DIR}/data/.pm2 \
+  HOME=/root
 
-ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PNPM_HOME}:${PYTHON_HOME}/bin \
+ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PNPM_HOME}:${PYTHON_HOME}/bin:${HOME}/bin \
   NODE_PATH=/usr/local/bin:/usr/local/lib/node_modules:${PNPM_HOME}/global/5/node_modules \
   PIP_CACHE_DIR=${PYTHON_HOME}/pip \
   PYTHONPATH=${PYTHON_HOME}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}/site-packages
@@ -83,6 +87,6 @@ COPY --from=builder /tmp/build/node_modules/. /ql/node_modules/
 WORKDIR ${QL_DIR}
 
 HEALTHCHECK --interval=5s --timeout=2s --retries=20 \
-  CMD curl -sf --noproxy '*' http://127.0.0.1:5700/api/health || exit 1
+  CMD curl -sf --noproxy '*' http://127.0.0.1:${QlPort:-5700}/api/health || exit 1
 
 ENTRYPOINT ["./docker/docker-entrypoint.sh"]

docker/Dockerfile

@@ -65,13 +65,17 @@ RUN git clone --depth=1 -b ${QL_BRANCH} ${QL_URL} ${QL_DIR} \
   && git clone --depth=1 -b ${QL_BRANCH} https://github.com/${QL_MAINTAINER}/qinglong-static.git /static \
   && mkdir -p ${QL_DIR}/static \
   && cp -rf /static/* ${QL_DIR}/static \
-  && rm -rf /static
+  && rm -rf /static \
+  && mkdir -p ${QL_DIR}/.tmp ${QL_DIR}/shell/preload \
+  && chmod -R a+w ${QL_DIR}/.tmp ${QL_DIR}/shell/preload ${QL_DIR}/static
 
 ENV PNPM_HOME=${QL_DIR}/data/dep_cache/node \
   PYTHON_HOME=${QL_DIR}/data/dep_cache/python3 \
-  PYTHONUSERBASE=${QL_DIR}/data/dep_cache/python3
+  PYTHONUSERBASE=${QL_DIR}/data/dep_cache/python3 \
+  PM2_HOME=${QL_DIR}/data/.pm2 \
+  HOME=/root
 
-ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PNPM_HOME}:${PYTHON_HOME}/bin \
+ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PNPM_HOME}:${PYTHON_HOME}/bin:${HOME}/bin \
   NODE_PATH=/usr/local/bin:/usr/local/lib/node_modules:${PNPM_HOME}/global/5/node_modules \
   PIP_CACHE_DIR=${PYTHON_HOME}/pip \
   PYTHONPATH=${PYTHON_HOME}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}/site-packages
@@ -83,6 +87,6 @@ COPY --from=builder /tmp/build/node_modules/. /ql/node_modules/
 WORKDIR ${QL_DIR}
 
 HEALTHCHECK --interval=5s --timeout=2s --retries=20 \
-  CMD curl -sf --noproxy '*' http://127.0.0.1:5700/api/health || exit 1
+  CMD curl -sf --noproxy '*' http://127.0.0.1:${QlPort:-5700}/api/health || exit 1
 
 ENTRYPOINT ["./docker/docker-entrypoint.sh"]

docker/docker-entrypoint.sh

@@ -1,7 +1,5 @@
 #!/bin/bash
 
-export PATH="$HOME/bin:$PATH"
-
 dir_shell=/ql/shell
 . $dir_shell/share.sh
 
@@ -17,10 +15,10 @@ log_with_style() {
   printf "\n[%s] [%7s]  %s\n" "${timestamp}" "${level}" "${message}"
 }
 
-# Fix DNS resolution issues in Alpine Linux
+# Fix DNS resolution issues in Alpine Linux (requires root)
 # Alpine uses musl libc which has known DNS resolver issues with certain domains
 # Adding ndots:0 prevents unnecessary search domain appending
-if [ -f /etc/alpine-release ]; then
+if [ "$(id -u)" = "0" ] && [ -f /etc/alpine-release ]; then
   if ! grep -q "^options ndots:0" /etc/resolv.conf 2>/dev/null; then
     echo "options ndots:0" >> /etc/resolv.conf
     log_with_style "INFO" "🔧  0. 已配置 DNS 解析优化 (ndots:0)"
@@ -52,6 +50,11 @@ fi
 
 log_with_style "SUCCESS" "🎉  容器启动成功!"
 
+if [ "$(id -u)" = "0" ]; then
   crond -f >/dev/null
+else
+  # crond requires root in Alpine; keep container alive without it
+  exec tail -f /dev/null
+fi
 
 exec "$@"

package.json

@@ -77,9 +77,9 @@
     "js-yaml": "^4.1.0",
     "jsonwebtoken": "^9.0.2",
     "lodash": "^4.17.21",
-    "multer": "1.4.5-lts.1",
+    "multer": "2.1.1",
     "node-schedule": "^2.1.0",
-    "nodemailer": "^6.9.16",
+    "nodemailer": "^8.0.1",
     "p-queue-cjs": "7.3.4",
     "@bufbuild/protobuf": "^2.10.0",
     "ps-tree": "^1.2.0",

version.yaml

@@ -1,11 +1,6 @@
-version: 2.20.1
+version: 2.20.2
-changeLogLink: https://t.me/jiao_long/433
+changeLogLink: https://t.me/jiao_long/434
-publishTime: 2025-12-26 22:00
+publishTime: 2026-03-01 1800
 changeLog: |
-  1. 修复获取依赖管理列表
+  1. 修复 path 安全漏洞（重要）
-  2. notify.js 修复 TG_PROXY_AUTH 参数拼接
+  
-  3. QLAPI.notify larkSecret 参数
-  4. 修复 cron parser 定时规则校验
-  5. 修复设置 baseUrl 后无法访问
-  6. 修复环境变量排序
-  7. 修复定时任务无法停止