Upgrade multer from 1.4.5-lts.1 to 2.1.1 to fix security vulnerabilities

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
Fix Python relative path issue: correct CWD for subdirectory scripts
2026-08-06 00:34:33 +08:00 · 2026-03-07 13:40:32 +00:00 · 2026-03-07 13:35:25 +00:00 · 2026-03-07 13:27:02 +00:00 · 2026-03-01 20:35:25 +08:00 · 2026-03-01 20:35:19 +08:00
12 changed files with 105 additions and 219 deletions
@@ -10,7 +10,6 @@ import Logger from '../loaders/logger';
 import { writeFileWithLock } from '../shared/utils';
 import { DependenceTypes } from '../data/dependence';
 import { FormData } from 'undici';
-import os from 'os';

 export * from './share';

@@ -591,162 +590,3 @@ export function getUninstallCommand(
 export function isDemoEnv() {
  return process.env.DeployEnv === 'demo';
 }
-
-// OS detection for Linux mirror configuration
-let osType: 'Debian' | 'Ubuntu' | 'Alpine' | undefined;
-
-async function getOSReleaseInfo(): Promise<string> {
-  try {
-    const osRelease = await fs.readFile('/etc/os-release', 'utf8');
-    return osRelease;
-  } catch (error) {
-    Logger.error(`Failed to read /etc/os-release: ${error}`);
-    return '';
-  }
-}
-
-function isDebian(osReleaseInfo: string): boolean {
-  return osReleaseInfo.includes('Debian');
-}
-
-function isUbuntu(osReleaseInfo: string): boolean {
-  return osReleaseInfo.includes('Ubuntu');
-}
-
-function isAlpine(osReleaseInfo: string): boolean {
-  return osReleaseInfo.includes('Alpine');
-}
-
-export async function detectOS(): Promise<
-  'Debian' | 'Ubuntu' | 'Alpine' | undefined
-> {
-  if (osType) return osType;
-  const platform = os.platform();
-
-  if (platform === 'linux') {
-    const osReleaseInfo = await getOSReleaseInfo();
-    // Check Ubuntu before Debian since Ubuntu is based on Debian
-    if (isUbuntu(osReleaseInfo)) {
-      osType = 'Ubuntu';
-    } else if (isDebian(osReleaseInfo)) {
-      osType = 'Debian';
-    } else if (isAlpine(osReleaseInfo)) {
-      osType = 'Alpine';
-    } else {
-      Logger.error(`Unknown Linux Distribution: ${osReleaseInfo}`);
-      console.error(`Unknown Linux Distribution: ${osReleaseInfo}`);
-    }
-  } else if (platform === 'darwin') {
-    osType = undefined;
-  } else {
-    Logger.error(`Unsupported platform: ${platform}`);
-    console.error(`Unsupported platform: ${platform}`);
-  }
-
-  return osType;
-}
-
-async function getCurrentMirrorDomain(
-  filePath: string,
-): Promise<string | null> {
-  try {
-    const fileContent = await fs.readFile(filePath, 'utf8');
-    const lines = fileContent.split('\n');
-    for (const line of lines) {
-      if (line.trim().startsWith('#')) {
-        continue;
-      }
-      const match = line.match(/https?:\/\/[^\/]+/);
-      if (match) {
-        return match[0];
-      }
-    }
-    return null;
-  } catch (error) {
-    Logger.error(`Failed to read mirror configuration file ${filePath}: ${error}`);
-    return null;
-  }
-}
-
-function escapeRegExp(string: string): string {
-  return string.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
-
-async function replaceDomainInFile(
-  filePath: string,
-  oldDomainWithScheme: string,
-  newDomainWithScheme: string,
-): Promise<void> {
-  // Ensure the new domain has a trailing slash before replacement
-  if (!newDomainWithScheme.endsWith('/')) {
-    newDomainWithScheme += '/';
-  }
-
-  let fileContent = await fs.readFile(filePath, 'utf8');
-  // Escape special regex characters in the old domain
-  const escapedOldDomain = escapeRegExp(oldDomainWithScheme);
-  let updatedContent = fileContent.replace(
-    new RegExp(escapedOldDomain, 'g'),
-    newDomainWithScheme,
-  );
-
-  await writeFileWithLock(filePath, updatedContent);
-}
-
-async function _updateLinuxMirror(
-  osType: string,
-  mirrorDomainWithScheme: string,
-): Promise<string> {
-  let filePath: string, currentDomainWithScheme: string | null;
-  switch (osType) {
-    case 'Debian':
-      filePath = '/etc/apt/sources.list.d/debian.sources';
-      currentDomainWithScheme = await getCurrentMirrorDomain(filePath);
-      if (currentDomainWithScheme) {
-        await replaceDomainInFile(
-          filePath,
-          currentDomainWithScheme,
-          mirrorDomainWithScheme || 'http://deb.debian.org',
-        );
-        return 'apt-get update';
-      } else {
-        throw Error(`Current mirror domain not found.`);
-      }
-    case 'Ubuntu':
-      filePath = '/etc/apt/sources.list.d/ubuntu.sources';
-      currentDomainWithScheme = await getCurrentMirrorDomain(filePath);
-      if (currentDomainWithScheme) {
-        await replaceDomainInFile(
-          filePath,
-          currentDomainWithScheme,
-          mirrorDomainWithScheme || 'http://archive.ubuntu.com',
-        );
-        return 'apt-get update';
-      } else {
-        throw Error(`Current mirror domain not found.`);
-      }
-    case 'Alpine':
-      filePath = '/etc/apk/repositories';
-      currentDomainWithScheme = await getCurrentMirrorDomain(filePath);
-      if (currentDomainWithScheme) {
-        await replaceDomainInFile(
-          filePath,
-          currentDomainWithScheme,
-          mirrorDomainWithScheme || 'http://dl-cdn.alpinelinux.org',
-        );
-        return 'apk update';
-      } else {
-        throw Error(`Current mirror domain not found.`);
-      }
-    default:
-      throw Error('Unsupported OS type for updating mirrors.');
-  }
-}
-
-export async function updateLinuxMirrorFile(mirror: string): Promise<string> {
-  const detectedOS = await detectOS();
-  if (!detectedOS) {
-    throw Error(`Unknown Linux Distribution`);
-  }
-  return await _updateLinuxMirror(detectedOS, mirror);
-}
@@ -13,9 +13,29 @@ import { isValidToken } from '../shared/auth';
 import path from 'path';

 export default ({ app }: { app: Application }) => {
+  // Security: Enable strict routing to prevent case-insensitive path bypass
+  app.set('case sensitive routing', true);
+  app.set('strict routing', true);
  app.set('trust proxy', 'loopback');
  app.use(cors());
  
+  // Security: Path normalization middleware to prevent case variation attacks
+  app.use((req, res, next) => {
+    const originalPath = req.path;
+    const normalizedPath = originalPath.toLowerCase();
+    
+    // Block requests with case variations on protected paths
+    if (originalPath !== normalizedPath && 
+        (normalizedPath.startsWith('/api/') || normalizedPath.startsWith('/open/'))) {
+      return res.status(400).json({
+        code: 400,
+        message: 'Invalid path format'
+      });
+    }
+    
+    next();
+  });
+  
  // Rewrite URLs to strip baseUrl prefix if configured
  // This allows the rest of the app to work without baseUrl awareness
  if (config.baseUrl) {
@@ -36,7 +56,7 @@ export default ({ app }: { app: Application }) => {
      secret: config.jwt.secret,
      algorithms: ['HS384'],
    }).unless({
-      path: [...config.apiWhiteList, /^\/(?!api\/).*/],
+      path: [...config.apiWhiteList, /^(\/(?!api\/).*)$/i],
    }),
  );

@@ -51,19 +71,20 @@ export default ({ app }: { app: Application }) => {
  });

  app.use(async (req: Request, res, next) => {
-    if (!['/open/', '/api/'].some((x) => req.path.startsWith(x))) {
+    const pathLower = req.path.toLowerCase();
+    if (!['/open/', '/api/'].some((x) => pathLower.startsWith(x))) {
      return next();
    }

    const headerToken = getToken(req);
-    if (req.path.startsWith('/open/')) {
+    if (pathLower.startsWith('/open/')) {
      const apps = await shareStore.getApps();
      const doc = apps?.filter((x) =>
        x.tokens?.find((y) => y.value === headerToken),
      )?.[0];
      if (doc && doc.tokens && doc.tokens.length > 0) {
        const currentToken = doc.tokens.find((x) => x.value === headerToken);
-        const keyMatch = req.path.match(/\/open\/([a-z]+)\/*/);
+        const keyMatch = pathLower.match(/\/open\/([a-z]+)\/*/);
        const key = keyMatch && keyMatch[1];
        if (
          doc.scopes.includes(key as any) &&
@@ -98,7 +119,15 @@ export default ({ app }: { app: Application }) => {
  });

  app.use(async (req, res, next) => {
-    if (!['/api/user/init', '/api/user/notification/init'].includes(req.path)) {
+    const pathLower = req.path.toLowerCase();
+    if (
+      ![
+        '/api/user/init',
+        '/api/user/notification/init',
+        '/open/user/init',
+        '/open/user/notification/init',
+      ].includes(req.path)
+    ) {
      return next();
    }
    const authInfo =
@@ -13,7 +13,7 @@ import { AuthDataType, SystemModel } from '../data/system';
 import SystemService from '../services/system';
 import UserService from '../services/user';
 import { writeFile, readFile } from 'fs/promises';
-import { createRandomString, fileExist, safeJSONParse } from '../config/util';
+import { createRandomString, fileExist, isDemoEnv, safeJSONParse } from '../config/util';
 import OpenService from '../services/open';
 import { shareStore } from '../shared/store';
 import Logger from './logger';
@@ -50,7 +50,7 @@ export default async () => {
  const [authConfig] = await SystemModel.findOrCreate({
    where: { type: AuthDataType.authConfig },
  });
-  if (!authConfig?.info) {
+  if (!authConfig?.info || isDemoEnv()) {
    let authInfo = {
      username: 'admin',
      password: 'admin',
@@ -17,7 +17,6 @@ import {
  readDirs,
  rmPath,
  setSystemTimezone,
-  updateLinuxMirrorFile,
 } from '../config/util';
 import {
  DependenceModel,
@@ -215,11 +214,33 @@ export default class SystemService {
    onEnd?: () => void,
  ) {
    const oDoc = await this.getSystemConfig();
+    await this.updateAuthDb({
+      ...oDoc,
+      info: { ...oDoc.info, ...info },
+    });
+    let defaultDomain = 'https://dl-cdn.alpinelinux.org';
+    let targetDomain = 'https://dl-cdn.alpinelinux.org';
    if (os.platform() !== 'linux') {
      return;
    }
-    const command = await updateLinuxMirrorFile(info.linuxMirror || '');
-    let hasError = false;
+    const content = await fs.promises.readFile('/etc/apk/repositories', {
+      encoding: 'utf-8',
+    });
+    const domainMatch = content.match(/(http.*)\/alpine\/.*/);
+    if (domainMatch) {
+      defaultDomain = domainMatch[1];
+    }
+    if (info.linuxMirror) {
+      targetDomain = info.linuxMirror;
+    }
+    const command = `sed -i 's/${defaultDomain.replace(
+      /\//g,
+      '\\/',
+    )}/${targetDomain.replace(
+      /\//g,
+      '\\/',
+    )}/g' /etc/apk/repositories && apk update -f`;
+
    this.scheduleService.runTask(
      command,
      {
@@ -233,15 +254,8 @@ export default class SystemService {
            message: 'update linux mirror end',
          });
          onEnd?.();
-          if (!hasError) {
-            await this.updateAuthDb({
-              ...oDoc,
-              info: { ...oDoc.info, ...info },
-            });
-          }
        },
        onError: async (message: string) => {
-          hasError = true;
          this.sockService.sendMessage({ type: 'updateLinuxMirror', message });
        },
        onLog: async (message: string) => {
@@ -69,9 +69,10 @@ RUN git clone --depth=1 -b ${QL_BRANCH} ${QL_URL} ${QL_DIR} \

 ENV PNPM_HOME=${QL_DIR}/data/dep_cache/node \
  PYTHON_HOME=${QL_DIR}/data/dep_cache/python3 \
-  PYTHONUSERBASE=${QL_DIR}/data/dep_cache/python3
+  PYTHONUSERBASE=${QL_DIR}/data/dep_cache/python3 \
+  HOME=/root

-ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PNPM_HOME}:${PYTHON_HOME}/bin \
+ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PNPM_HOME}:${PYTHON_HOME}/bin:${HOME}/bin \
  NODE_PATH=/usr/local/bin:/usr/local/lib/node_modules:${PNPM_HOME}/global/5/node_modules \
  PIP_CACHE_DIR=${PYTHON_HOME}/pip \
  PYTHONPATH=${PYTHON_HOME}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}/site-packages
@@ -69,9 +69,10 @@ RUN git clone --depth=1 -b ${QL_BRANCH} ${QL_URL} ${QL_DIR} \

 ENV PNPM_HOME=${QL_DIR}/data/dep_cache/node \
  PYTHON_HOME=${QL_DIR}/data/dep_cache/python3 \
-  PYTHONUSERBASE=${QL_DIR}/data/dep_cache/python3
+  PYTHONUSERBASE=${QL_DIR}/data/dep_cache/python3 \
+  HOME=/root

-ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PNPM_HOME}:${PYTHON_HOME}/bin \
+ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PNPM_HOME}:${PYTHON_HOME}/bin:${HOME}/bin \
  NODE_PATH=/usr/local/bin:/usr/local/lib/node_modules:${PNPM_HOME}/global/5/node_modules \
  PIP_CACHE_DIR=${PYTHON_HOME}/pip \
  PYTHONPATH=${PYTHON_HOME}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}/site-packages
@@ -1,7 +1,5 @@
 #!/bin/bash

-export PATH="$HOME/bin:$PATH"
-
 dir_shell=/ql/shell
 . $dir_shell/share.sh

@@ -77,7 +77,7 @@
    "js-yaml": "^4.1.0",
    "jsonwebtoken": "^9.0.2",
    "lodash": "^4.17.21",
-    "multer": "1.4.5-lts.1",
+    "multer": "2.1.1",
    "node-schedule": "^2.1.0",
    "nodemailer": "^6.9.16",
    "p-queue-cjs": "7.3.4",
@@ -118,7 +118,7 @@
    "@types/js-yaml": "^4.0.5",
    "@types/jsonwebtoken": "^8.5.8",
    "@types/lodash": "^4.14.185",
-    "@types/multer": "^1.4.7",
+    "@types/multer": "^2.0.0",
    "@types/node": "^17.0.21",
    "@types/node-schedule": "^1.3.2",
    "@types/nodemailer": "^6.4.4",
@@ -1,9 +1,5 @@
 lockfileVersion: '6.0'

-settings:
-  autoInstallPeers: true
-  excludeLinksFromLockfile: false
-
 overrides:
  sqlite3: git+https://github.com/whyour/node-sqlite3.git#v1.0.3

@@ -90,8 +86,8 @@ dependencies:
    specifier: ^4.17.21
    version: 4.17.21
  multer:
-    specifier: 1.4.5-lts.1
-    version: 1.4.5-lts.1
+    specifier: 2.1.1
+    version: 2.1.1
  node-schedule:
    specifier: ^2.1.0
    version: 2.1.1
@@ -194,8 +190,8 @@ devDependencies:
    specifier: ^4.14.185
    version: 4.17.13
  '@types/multer':
-    specifier: ^1.4.7
-    version: 1.4.12
+    specifier: ^2.0.0
+    version: 2.0.0
  '@types/node':
    specifier: ^17.0.21
    version: 17.0.45
@@ -3960,8 +3956,8 @@ packages:
    resolution: {integrity: sha512-nG96G3Wp6acyAgJqGasjODb+acrI7KltPiRxzHPXnP3NgI28bpQDRv53olbqGXbfcgF5aiiHmO3xpwEpS5Ld9g==}
    dev: false

-  /@types/multer@1.4.12:
-    resolution: {integrity: sha512-pQ2hoqvXiJt2FP9WQVLPRO+AmiIm/ZYkavPlIQnx282u4ZrVdztx0pkh3jjpQt0Kz+YI0YhSG264y08UJKoUQg==}
+  /@types/multer@2.0.0:
+    resolution: {integrity: sha512-C3Z9v9Evij2yST3RSBktxP9STm6OdMc5uR1xF1SGr98uv8dUlAL2hqwrZ3GVB3uyMyiegnscEK6PGtYvNrjTjw==}
    dependencies:
      '@types/express': 4.17.21
    dev: true
@@ -6333,13 +6329,13 @@ packages:
  /concat-map@0.0.1:
    resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==}

-  /concat-stream@1.6.2:
-    resolution: {integrity: sha512-27HBghJxjiZtIk3Ycvn/4kbJk/1uZuJFfuPEns6LaEvpvG1f0hTea8lilrouyo9mVc2GWdcEZ8OLoGmSADlrCw==}
-    engines: {'0': node >= 0.8}
+  /concat-stream@2.0.0:
+    resolution: {integrity: sha512-MWufYdFw53ccGjCA+Ol7XJYpAlW6/prSMzuPOTRnJGcGzuhLn4Scrz7qf6o8bROZ514ltazcIFJZevcfbo0x7A==}
+    engines: {'0': node >= 6.0}
    dependencies:
      buffer-from: 1.1.2
      inherits: 2.0.4
-      readable-stream: 2.3.8
+      readable-stream: 3.6.2
      typedarray: 0.0.6
    dev: false

@@ -6436,6 +6432,7 @@ packages:

  /core-util-is@1.0.3:
    resolution: {integrity: sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==}
+    dev: true

  /cors@2.8.5:
    resolution: {integrity: sha512-KIHbLJqu73RGr/hnbrO9uBeixNGuvSQjul/jdFvS/KFSIH1hWVd1ng7zOHx+YrEfInLG7q4n6GHQ9cDtxv/P6g==}
@@ -8288,6 +8285,7 @@ packages:

  /glob@10.4.5:
    resolution: {integrity: sha512-7Bv8RF0k6xjo7d4A/PxYLbUCfb6c+Vpd2/mB2yRDlew7Jb5hEXiCD9ibfO7wpk8i4sevK6DFny9h7EYbM3/sHg==}
+    deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
    hasBin: true
    dependencies:
      foreground-child: 3.3.0
@@ -8300,7 +8298,7 @@ packages:

  /glob@7.2.3:
    resolution: {integrity: sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==}
-    deprecated: Glob versions prior to v9 are no longer supported
+    deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
    dependencies:
      fs.realpath: 1.0.0
      inflight: 1.0.6
@@ -9171,6 +9169,7 @@ packages:

  /isarray@1.0.0:
    resolution: {integrity: sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==}
+    dev: true

  /isarray@2.0.5:
    resolution: {integrity: sha512-xHjhDr3cNBK0BzdUJSPXZntQUx/mwMS5Rw4A7lPJ90XGAO6ISP/ePDNuo0vhqOZU+UD5JoodwCAAoZQd3FeAKw==}
@@ -10037,6 +10036,7 @@ packages:

  /minimist@1.2.8:
    resolution: {integrity: sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==}
+    dev: true

  /minipass-collect@1.0.2:
    resolution: {integrity: sha512-6T6lH0H8OG9kITm/Jm6tdooIbogG9e0tLgpY6mphXSm/A9u8Nq1ryBG+Qspiub9LjWlBPsPS3tWQ/Botq4FdxA==}
@@ -10117,6 +10117,7 @@ packages:
    hasBin: true
    dependencies:
      minimist: 1.2.8
+    dev: true

  /mkdirp@1.0.4:
    resolution: {integrity: sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==}
@@ -10151,17 +10152,14 @@ packages:
  /ms@2.1.3:
    resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}

-  /multer@1.4.5-lts.1:
-    resolution: {integrity: sha512-ywPWvcDMeH+z9gQq5qYHCCy+ethsk4goepZ45GLD63fOu0YcNecQxi64nDs3qluZB+murG3/D4dJ7+dGctcCQQ==}
-    engines: {node: '>= 6.0.0'}
+  /multer@2.1.1:
+    resolution: {integrity: sha512-mo+QTzKlx8R7E5ylSXxWzGoXoZbOsRMpyitcht8By2KHvMbf3tjwosZ/Mu/XYU6UuJ3VZnODIrak5ZrPiPyB6A==}
+    engines: {node: '>= 10.16.0'}
    dependencies:
      append-field: 1.0.0
      busboy: 1.6.0
-      concat-stream: 1.6.2
-      mkdirp: 0.5.6
-      object-assign: 4.1.1
+      concat-stream: 2.0.0
      type-is: 1.6.18
-      xtend: 4.0.2
    dev: false

  /mz@2.7.0:
@@ -11530,6 +11528,7 @@ packages:

  /process-nextick-args@2.0.1:
    resolution: {integrity: sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==}
+    dev: true

  /process-okam@0.11.10:
    resolution: {integrity: sha512-p8e5nl6/OCeMalVb9dSojND5B9m/nq64WsyUfRmrTdLMKcNYcDN++/2I8WV1mTQDqrh2PQ6tIIb2A7/A38eSvw==}
@@ -12951,6 +12950,7 @@ packages:
      safe-buffer: 5.1.2
      string_decoder: 1.1.1
      util-deprecate: 1.0.2
+    dev: true

  /readable-stream@3.6.2:
    resolution: {integrity: sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==}
@@ -13221,6 +13221,7 @@ packages:

  /safe-buffer@5.1.2:
    resolution: {integrity: sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==}
+    dev: true

  /safe-buffer@5.2.1:
    resolution: {integrity: sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==}
@@ -13868,6 +13869,7 @@ packages:
    resolution: {integrity: sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==}
    dependencies:
      safe-buffer: 5.1.2
+    dev: true

  /string_decoder@1.3.0:
    resolution: {integrity: sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==}
@@ -14152,6 +14154,7 @@ packages:
  /tar@6.2.1:
    resolution: {integrity: sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==}
    engines: {node: '>=10'}
+    deprecated: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
    dependencies:
      chownr: 2.0.0
      fs-minipass: 2.1.0
@@ -15140,6 +15143,7 @@ packages:
  /xtend@4.0.2:
    resolution: {integrity: sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ==}
    engines: {node: '>=0.4'}
+    dev: true

  /y18n@5.0.8:
    resolution: {integrity: sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==}
@@ -15225,3 +15229,7 @@ packages:
      - encoding
      - supports-color
    dev: false
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
@@ -92,7 +92,7 @@ run_normal() {

  cd $dir_scripts
  local relative_path="${file_param%/*}"
-  if [[ ${file_param} != /* ]] && [[ ! -z ${relative_path} ]] && [[ ${file_param} =~ "/" ]]; then
+  if [[ ! -z ${relative_path} ]] && [[ ${file_param} =~ "/" ]]; then
    cd ${relative_path}
    file_param=${file_param/$relative_path\//}
  fi
@@ -42,7 +42,7 @@ def run():
        os.environ["PYTHONPATH"] = prev_pythonpath

        split_str = "__sitecustomize__"
-        file_name = sys.argv[0].replace(f"{os.getenv('dir_scripts')}/", "")
+        file_name = os.path.abspath(sys.argv[0]).replace(f"{os.getenv('dir_scripts')}/", "")
        
        # 创建临时文件路径
        temp_file = f"/tmp/env_{os.getpid()}.json"
@@ -1,11 +1,6 @@
-version: 2.20.1
-changeLogLink: https://t.me/jiao_long/433
-publishTime: 2025-12-26 22:00
+version: 2.20.2
+changeLogLink: https://t.me/jiao_long/434
+publishTime: 2026-03-01 1800
 changeLog: |
-  1. 修复获取依赖管理列表
-  2. notify.js 修复 TG_PROXY_AUTH 参数拼接
-  3. QLAPI.notify larkSecret 参数
-  4. 修复 cron parser 定时规则校验
-  5. 修复设置 baseUrl 后无法访问
-  6. 修复环境变量排序
-  7. 修复定时任务无法停止
+  1. 修复 path 安全漏洞（重要）
+
Author	SHA1	Message	Date
copilot-swe-agent[bot]	faa38294d6	Upgrade multer from 1.4.5-lts.1 to 2.1.1 to fix security vulnerabilities Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>	2026-03-07 13:40:32 +00:00
copilot-swe-agent[bot]	e8abaeb83c	Fix Python relative path issue: correct CWD for subdirectory scripts Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>	2026-03-07 13:35:25 +00:00
copilot-swe-agent[bot]	bf7350f10b	Initial plan	2026-03-07 13:27:02 +00:00
whyour	275d8af4e2	更新版本 v2.20.2	2026-03-01 20:35:25 +08:00
whyour	544c432f49	修复 PATH 环境变量	2026-03-01 20:35:19 +08:00
Copilot	6bec52dca1	Fix /open/user/init auth bypass allowing credential reset on initialized systems (#2941 ) * Initial plan * fix: add /open/user/init paths to init guard to prevent auth bypass Co-authored-by: whyour <22700758+whyour@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: whyour <22700758+whyour@users.noreply.github.com> Co-authored-by: whyour <imwhyour@gmail.com>	2026-03-01 18:02:21 +08:00
rockymelody	ce599d306f	青龙面板鉴权绕过漏洞已修复 (#2935 ) 已实施的安全加固措施第一层防御：启用Express严格路由（第17-18行） app.set('case sensitive routing', true); // 路由大小写敏感 app.set('strict routing', true); // 严格路由匹配第二层防御：路径标准化检查中间件（第23-37行） app.use((req, res, next) => { const originalPath = req.path; const normalizedPath = originalPath.toLowerCase(); // 检测并拦截大小写混淆攻击 if (originalPath !== normalizedPath && (normalizedPath.startsWith('/api/') \|\| normalizedPath.startsWith('/open/'))) { return res.status(400).json({ code: 400, message: 'Invalid path format' }); } next(); }); 作用：主动检测并拒绝含有大小写变体的恶意请求第三层防御：JWT中间件正则表达式修复（第59行） // 修复前： path: [...config.apiWhiteList, /^\/(?!api\/)./], // 修复后：添加大小写不敏感标志 'i' path: [...config.apiWhiteList, /^(\/(?!api\/).)$/i], 作用：防御正则匹配层面的绕过第四层防御：自定义Token中间件路径标准化（第74-87行） // 修复前： if (!['/open/', '/api/'].some((x) => req.path.startsWith(x))) { // 修复后：统一转小写比较 const pathLower = req.path.toLowerCase(); if (!['/open/', '/api/'].some((x) => pathLower.startsWith(x))) { } 作用：确保Token验证逻辑对所有路径变体生效第五层防御：初始化接口路径检查修复（第122-123行） // 修复前： if (!['/api/user/init', '/api/user/notification/init'].includes(req.path)) { // 修复后： const pathLower = req.path.toLowerCase(); if (!['/api/user/init', '/api/user/notification/init'].includes(pathLower)) {	2026-03-01 17:44:03 +08:00