@whyour/qinglong 2.20.2-3 → 2.21.0

package/shell/preload/esm-loader.mjs

@@ -0,0 +1,41 @@
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+
+const builtinModules = [
+  'assert', 'buffer', 'child_process', 'cluster', 'crypto', 'dgram', 'dns',
+  'events', 'fs', 'http', 'https', 'net', 'os', 'path', 'process', 'querystring',
+  'readline', 'stream', 'string_decoder', 'timers', 'tls', 'tty', 'url', 'util',
+  'v8', 'zlib',
+];
+
+function isBareSpecifier(specifier) {
+  return !specifier.startsWith('.') &&
+    !specifier.startsWith('/') &&
+    !specifier.startsWith('file:') &&
+    !specifier.startsWith('node:') &&
+    !builtinModules.includes(specifier) &&
+    !builtinModules.includes(specifier.split('/')[0]);
+}
+
+export function resolve(specifier, context, nextResolve) {
+  if (!isBareSpecifier(specifier)) {
+    return nextResolve(specifier, context);
+  }
+
+  // 解析优先级：全局 pnpm > 系统全局
+  const bases = [
+    process.env.QL_NODE_GLOBAL_PATH,
+    '/usr/local/lib/node_modules',
+  ].filter(Boolean);
+
+  for (const base of bases) {
+    if (existsSync(join(base, specifier))) {
+      return nextResolve(specifier, {
+        ...context,
+        parentURL: new URL(`${join(base, specifier)}/`, 'file://').href,
+      });
+    }
+  }
+
+  return nextResolve(specifier, context);
+}

package/shell/preload/sitecustomize.js

@@ -1,7 +1,41 @@
 const { execSync } = require('child_process');
+const Module = require('module');
+const path = require('path');
 const client = require('./client.js');
 require(`./env.js`);
 
+// 注册 ESM loader，使全局安装的包也可通过 import 导入
+try {
+  Module.register(new URL('esm-loader.mjs', `file://${__dirname}/`).href);
+} catch (_) {}
+
+function preferGlobalNodeModules() {
+  const { QL_NODE_GLOBAL_PATH } = process.env;
+  if (!QL_NODE_GLOBAL_PATH || Module._qlGlobalPathPatched) {
+    return;
+  }
+
+  const originalResolveFilename = Module._resolveFilename;
+  Module._resolveFilename = function (request, parent, isMain, options) {
+    if (
+      !Module.builtinModules.includes(request) &&
+      !request.startsWith('node:') &&
+      !request.startsWith('.') &&
+      !path.isAbsolute(request)
+    ) {
+      try {
+        return originalResolveFilename.call(this, request, parent, isMain, {
+          ...options,
+          paths: [QL_NODE_GLOBAL_PATH],
+        });
+      } catch (error) {}
+    }
+
+    return originalResolveFilename.call(this, request, parent, isMain, options);
+  };
+  Module._qlGlobalPathPatched = true;
+}
+
 function expandRange(rangeStr, max) {
   const tempRangeStr = rangeStr
     .trim()
@@ -113,6 +147,8 @@ try {
     return;
   }
 
+  preferGlobalNodeModules();
+
   process.on('SIGTERM', (code) => {
     process.exit(15);
   });

package/shell/pub.sh

@@ -1,26 +1,26 @@
 #!/usr/bin/env bash
 echo -e "开始发布"
 
-echo -e "切换 debian 分支"
-git branch -D debian
-git checkout -b debian
-git push --set-upstream origin debian -f
+echo -e "切换master分支"
+git branch -D master
+git checkout -b master
+git push --set-upstream origin master -f
 
 echo -e "更新cdn文件"
 ts-node-transpile-only sample/tool.ts
 
 string=$(cat version.yaml | grep "version" | egrep "[^ ]*" -o | egrep "\d\.*")
 version="v$string"
-echo -e "当前版本$version-debian"
+echo -e "当前版本$version"
 
 echo -e "删除已经存在的本地tag"
-git tag -d "$version-debian" &>/dev/null
+git tag -d "$version" &>/dev/null
 
 echo -e "删除已经存在的远程tag"
-git push origin :refs/tags/$version-debian &>/dev/null
+git push origin :refs/tags/$version &>/dev/null
 
 echo -e "创建新tag"
-git tag -a "$version-debian" -m "release $version-debian"
+git tag -a "$version" -m "release $version"
 
 echo -e "提交tag"
 git push --tags

package/shell/rmlog.sh

@@ -22,12 +22,12 @@ remove_js_log() {
     if [[ $diff_time -gt $((${days} * 86400)) ]]; then
       local log_path=$(echo "$log" | sed "s,${dir_log}/,,g")
       local result=$(find_cron_api "log_path=$log_path")
-      echo -e "查询文件 $log_path"
+      t '查询文件 %s' "$log_path"
       if [[ -z $result ]]; then
-        echo -e "删除中~"
+        t '删除中~'
         rm -vf $log
       else
-        echo -e "正在被 $result 使用，跳过~"
+        t '正在被 %s 使用，跳过~' "$result"
       fi
     fi
   done
@@ -43,8 +43,8 @@ remove_empty_dir() {
 }
 
 if [[ ${days} ]]; then
-  echo -e "查找旧日志文件中...\n"
+  t '查找旧日志文件中...\n'
   remove_js_log
   remove_empty_dir
-  echo -e "删除旧日志执行完毕\n"
+  t '删除旧日志执行完毕\n'
 fi

package/shell/share.sh

@@ -65,17 +65,7 @@ link_name=(
 )
 
 init_env() {
-  local pnpm_global_path=$(pnpm root -g 2>/dev/null)
-  export NODE_PATH="/usr/local/bin:/usr/local/lib/node_modules${pnpm_global_path:+:${pnpm_global_path}}"
-
-  # 如果存在 pnpm 全局路径，创建软链接
-  if [[ -n "$pnpm_global_path" ]]; then
-    # 确保目标目录存在
-    mkdir -p "${dir_root}/node_modules"
-    # 链接全局模块到项目的 node_modules
-    ln -sf "${pnpm_global_path}/"* "${dir_root}/node_modules/" 2>/dev/null || true
-  fi
-
+  export NODE_PATH="/usr/local/bin:/usr/local/lib/node_modules"
   export PYTHONUNBUFFERED=1
 }
 
@@ -88,6 +78,16 @@ load_ql_envs() {
 
 import_config() {
   [[ -f $file_config_user ]] && . $file_config_user
+  [[ -f $dir_preload/lang_env.sh ]] && . $dir_preload/lang_env.sh
+
+  # 加载语言包（bash 4+ 支持 declare -A，不兼容时回退输出中文 key）
+  local lang=${QL_LANG:-zh}
+  local lang_file="$dir_shell/lang/${lang}.sh"
+  if [[ ${BASH_VERSINFO[0]} -ge 4 ]] && [[ -f $lang_file ]]; then
+    . $lang_file
+  elif [[ ${BASH_VERSINFO[0]} -ge 4 ]]; then
+    . "$dir_shell/lang/zh.sh"
+  fi
 
   load_ql_envs
   command_timeout_time=${CommandTimeoutTime:-""}
@@ -101,6 +101,18 @@ import_config() {
   fi
 }
 
+t() {
+  local key="$1"
+  shift
+  local msg
+  if declare -p LANG_MESSAGES &>/dev/null; then
+    msg="${LANG_MESSAGES["$key"]}"
+  fi
+  [[ -z $msg ]] && msg="$key"
+  # shellcheck disable=SC2059
+  printf "$msg\n" "$@"
+}
+
 set_proxy() {
   local proxy="$1"
   if [[ $proxy ]]; then
@@ -235,7 +247,7 @@ npm_install_2() {
   local dir_work=$1
 
   cd $dir_work
-  echo -e "安装 $dir_work 依赖包...\n"
+  t '安装 %s 依赖包...\n' "$dir_work"
   npm_install_sub
   cd $dir_current
 }
@@ -254,7 +266,7 @@ git_clone_scripts() {
   local branch="$3"
   local proxy="$4"
   [[ $branch ]] && local part_cmd="-b $branch "
-  echo -e "开始拉取仓库 ${uniq_path} 到 $dir\n"
+  t '开始拉取仓库 %s 到 %s\n' "${uniq_path}" "$dir"
 
   set_proxy "$proxy"
 
@@ -287,18 +299,18 @@ reload_pm2() {
     return 0
   else
     local exit_code=$?
-    echo "警告: PM2 启动失败 (退出码: $exit_code)，可能是由于硬件不兼容"
-    echo "正在尝试直接使用 Node.js 启动服务..."
-    
+    t '警告: PM2 启动失败 (退出码: %s)，可能是由于硬件不兼容' "$exit_code"
+    t '正在尝试直接使用 Node.js 启动服务...'
+
     # Kill any existing node processes for qinglong
     pkill -f "node.*static/build/app.js" 2>/dev/null || true
-    
+
     # Start node directly in the background
     nohup node static/build/app.js > $dir_log/qinglong.log 2>&1 &
     local node_pid=$!
-    
-    echo "已使用 Node.js 直接启动服务 (PID: $node_pid)"
-    echo "注意: 使用此模式时，部分 PM2 管理功能将不可用"
+
+    t '已使用 Node.js 直接启动服务 (PID: %s)' "$node_pid"
+    t '注意: 使用此模式时，部分 PM2 管理功能将不可用'
     return 0
   fi
 }
@@ -370,16 +382,16 @@ handle_task_start() {
       error_message=", 任务状态更新失败(${error})"
     fi
   fi
-  echo -e "## 开始执行... ${begin_time}${error_message}\n"
+  t '## 开始执行... %s\n' "${begin_time}${error_message}"
 }
 
 run_task_before() {
   . $file_task_before "$@"
 
   if [[ ${task_before:=} ]]; then
-    echo -e "执行前置命令\n"
+    t '执行前置命令\n'
     eval "${task_before%;}"
-    echo -e "\n执行前置命令结束\n"
+    t '\n执行前置命令结束\n'
   fi
 }
 
@@ -387,9 +399,9 @@ run_task_after() {
   . $file_task_after "$@"
 
   if [[ ${task_after:=} ]]; then
-    echo -e "\n执行后置命令\n"
+    t '\n执行后置命令\n'
     eval "${task_after%;}"
-    echo -e "\n执行后置命令结束"
+    t '\n执行后置命令结束'
   fi
 }
 
@@ -398,18 +410,25 @@ handle_task_end() {
   local end_time=$(format_time "$time_format" "$etime")
   local end_timestamp=$(format_timestamp "$time_format" "$etime")
   local diff_time=$(($end_timestamp - $begin_timestamp))
-  local suffix=""
-  [[ "${MANUAL:=}" == "true" ]] && suffix="(手动停止)"
-
+  local exit_code="${_task_exit_code:-0}"
   [[ "$diff_time" == 0 ]] && diff_time=1
 
   if [[ $ID ]]; then
     local error=$(update_cron "\"$ID\"" "1" "$$" "$log_path" "$begin_timestamp" "$diff_time")
     if [[ $error ]]; then
-      error_message=", 任务状态更新失败(${error})"
+      error_message=", 状态更新失败(${error})"
     fi
   fi
-  echo -e "\n## 执行结束$suffix... $end_time  耗时 $diff_time 秒${error_message:=}　　　　　"
+
+  record_cron_stat "$ID" "${exit_code:-0}" "$diff_time"
+
+  if [[ "${MANUAL:=}" == "true" ]]; then
+    t '\n## 已停止 🛑... %s  耗时 %s 秒%s' "$end_time" "$diff_time" "${error_message:=}　　　　　"
+  elif [[ $exit_code -eq 0 ]]; then
+    t '\n## 完成 ✅... %s  耗时 %s 秒%s' "$end_time" "$diff_time" "${error_message:=}　　　　　"
+  else
+    t '\n## 失败 ❌(退出码 %s)... %s  耗时 %s 秒%s' "$exit_code" "$end_time" "$diff_time" "${error_message:=}　　　　　"
+  fi
 }
 
 init_env

package/shell/start.sh

@@ -12,23 +12,23 @@ if [[ ! $QL_DIR ]]; then
   elif [[ -d "$pnpm_dir/@whyour/qinglong" ]]; then
     QL_DIR="$pnpm_dir/@whyour/qinglong"
   else
-    echo -e "未找到 qinglong 模块，请先执行 npm i -g @whyour/qinglong 安装"
+    t '未找到 qinglong 模块，请先执行 npm i -g @whyour/qinglong 安装'
   fi
 
   if [[ $QL_DIR ]]; then
-    echo -e "请先手动设置 export QL_DIR=$QL_DIR，环境变量，并手动添加到系统环境变量，然后再次执行命令 qinglong 启动服务"
+    t '请先手动设置 export QL_DIR=%s，环境变量，并手动添加到系统环境变量，然后再次执行命令 qinglong 启动服务' "$QL_DIR"
   fi
 
   exit 1
 fi
 
 if [[ ! $QL_DATA_DIR ]]; then
-  echo -e "请先手动设置数据存储目录 export QL_DATA_DIR 环境变量，目录必须以斜杠开头的绝对路径，并且以 /data 结尾，例如 /ql/data 并手动添加到系统环境变量"
+  t '请先手动设置数据存储目录 export QL_DATA_DIR 环境变量，目录必须以斜杠开头的绝对路径，并且以 /data 结尾，例如 /ql/data 并手动添加到系统环境变量'
   exit 1
 fi
 
 if [[ $QL_DATA_DIR != */data ]]; then
-  echo -e "QL_DATA_DIR 必须以 /data 结尾，例如 /ql/data，如果有历史数据，请新建 data 目录，把历史数据放到 data 目录中"
+  t 'QL_DATA_DIR 必须以 /data 结尾，例如 /ql/data，如果有历史数据，请新建 data 目录，把历史数据放到 data 目录中'
   exit 1
 fi
 
@@ -36,31 +36,44 @@ command="$1"
 
 if [[ $command != "reload" ]]; then
   # 安装依赖
-  os_name=$(source /etc/os-release && echo "$ID")
-
-  if [[ $os_name == 'alpine' ]]; then
-    apk update
-    apk add -f bash \
-      coreutils \
-      git \
-      curl \
-      wget \
-      tzdata \
-      perl \
-      openssl \
-      jq \
-      nginx \
-      openssh \
-      procps \
-      netcat-openbsd
-  elif [[ $os_name == 'debian' ]] || [[ $os_name == 'ubuntu' ]]; then
-    apt-get update
-    apt-get install -y git curl wget tzdata perl openssl jq nginx procps netcat-openbsd openssh-client
-  else
-    echo -e "暂不支持此系统部署 $os_name"
-    exit 1
+  os_name="${QL_OS_TYPE:-}"
+  if [ -z "$os_name" ]; then
+    os_name=$(source /etc/os-release && echo "$ID")
+  fi
+
+  # 非 root 用户使用 sudo
+  SUDO=""
+  if [ "$(id -u)" -ne 0 ]; then
+    SUDO="sudo"
   fi
 
+  case "$os_name" in
+    alpine)
+      $SUDO apk update
+      $SUDO apk add -f bash \
+        coreutils \
+        git \
+        curl \
+        wget \
+        tzdata \
+        perl \
+        openssl \
+        jq \
+        nginx \
+        openssh \
+        procps \
+        netcat-openbsd
+      ;;
+    debian|ubuntu)
+      $SUDO apt-get update
+      $SUDO apt-get install -y git curl wget tzdata perl openssl jq nginx procps netcat-openbsd openssh-client
+      ;;
+    *)
+      t '暂不支持此系统部署 %s' "$os_name"
+      exit 1
+      ;;
+  esac
+
   npm install -g pnpm@8.3.1 pm2 ts-node
 fi
 

package/shell/task.sh

@@ -4,9 +4,17 @@ dir_shell=$QL_DIR/shell
 . $dir_shell/share.sh
 . $dir_shell/api.sh
 
-trap "single_hanle" 2 3 20 15 14 19 1
+trap 'single_hanle SIGINT'  INT
+trap 'single_hanle SIGTERM' TERM
+trap 'single_hanle SIGHUP'  HUP
+trap 'single_hanle SIGALRM' ALRM
+trap 'single_hanle SIGTSTP' TSTP
+trap 'single_hanle SIGQUIT' QUIT
+
 single_hanle() {
-  eval MANUAL=true handle_task_end "$@" "$cmd"
+  _task_exit_code="${_task_exit_code:-$?}"
+  [[ "$_task_exit_code" == "0" ]] && _task_exit_code="1"
+  eval MANUAL=true handle_task_end "$@"
   exit 1
 }
 

package/shell/update.sh

@@ -33,7 +33,7 @@ output_list_add_drop() {
   local list=$1
   local type=$2
   if [[ -s $list ]]; then
-    echo -e "检测到有${type}的定时任务:"
+    t '检测到有%s的定时任务:' "$type"
     cat $list
   fi
 }
@@ -45,7 +45,7 @@ del_cron() {
   local path=$2
   local detail=""
   local ids=""
-  echo -e "\n开始尝试自动删除失效的定时任务..."
+  t '\n开始尝试自动删除失效的定时任务...'
   for cron in $(cat $list_drop); do
     local id=$(cat $list_crontab_user | grep -E "$cmd_task.* $cron" | perl -pe "s|.*ID=(.*) $cmd_task.* $cron\.*|\1|" | head -1 | awk -F " " '{print $1}')
     if [[ $ids ]]; then
@@ -76,7 +76,7 @@ del_cron() {
 add_cron() {
   local list_add=$1
   local path=$2
-  echo -e "\n开始尝试自动添加定时任务..."
+  t '\n开始尝试自动添加定时任务...'
   local detail=""
   cd $dir_scripts
   for file in $(cat $list_add); do
@@ -136,10 +136,10 @@ update_repo() {
   git_clone_scripts "${formatUrl}" ${repo_path} "${branch}" "${proxy}"
 
   if [[ $exit_status -eq 0 ]]; then
-    echo -e "拉取 ${uniq_path} 成功...\n"
+    t '拉取 %s 成功...\n' "${uniq_path}"
     diff_scripts "$repo_path" "$author" "$path" "$blackword" "$dependence" "$extensions" "$autoAddCron" "$autoDelCron"
   else
-    echo -e "拉取 ${uniq_path} 失败，请检查日志...\n"
+    t '拉取 %s 失败，请检查日志...\n' "${uniq_path}"
   fi
 }
 
@@ -160,7 +160,7 @@ update_raw() {
   local raw_url="$url"
   local suffix="${raw_url##*.}"
   local raw_file_name="${uniq_path}.${suffix}"
-  echo -e "开始下载：${raw_url} \n\n保存路径：$dir_raw/${raw_file_name}\n"
+  t '开始下载：%s 保存路径：%s\n' "${raw_url}" "$dir_raw/${raw_file_name}"
 
   set_proxy "$proxy"
   wget -q --no-check-certificate -O "$dir_raw/${raw_file_name}.new" ${raw_url}
@@ -169,7 +169,7 @@ update_raw() {
 
   if [[ $? -eq 0 ]]; then
     mv "$dir_raw/${raw_file_name}.new" "$dir_raw/${raw_file_name}"
-    echo -e "下载 ${raw_file_name} 成功...\n"
+    t '下载 %s 成功...\n' "${raw_file_name}"
     cd $dir_raw
     local filename="raw_${raw_file_name}"
     local cron_id=$(cat $list_crontab_user | grep -E "$cmd_task.* $filename" | perl -pe "s|.*ID=(.*) $cmd_task.* $filename\.*|\1|" | head -1 | awk -F " " '{print $1}')
@@ -196,7 +196,7 @@ update_raw() {
       # update_cron_api "$cron_line:$cmd_task $filename:$cron_name:$cron_id"
     fi
   else
-    echo -e "下载 ${raw_file_name} 失败，保留之前正常下载的版本...\n"
+    t '下载 %s 失败，保留之前正常下载的版本...\n' "${raw_file_name}"
     [[ -f "$dir_raw/${raw_file_name}.new" ]] && rm -f "$dir_raw/${raw_file_name}.new"
   fi
 
@@ -207,13 +207,13 @@ run_extra_shell() {
   if [[ -f $file_extra_shell ]]; then
     . $file_extra_shell
   else
-    echo -e "$file_extra_shell文件不存在，跳过执行...\n"
+    t '%s文件不存在，跳过执行...\n' "$file_extra_shell"
   fi
 }
 
 ## 脚本用法
 usage() {
-  echo -e "$cmd_update 命令使用方法："
+  t "$cmd_update 命令使用方法："
   echo -e "1.  $cmd_update update                                                                  # 更新并重启青龙"
   echo -e "2.  $cmd_update extra                                                                   # 运行自定义脚本"
   echo -e "3.  $cmd_update raw <fileurl>                                                           # 更新单个脚本文件"
@@ -268,7 +268,7 @@ update_qinglong() {
     downloadQLUrl="https://github.com/whyour/qinglong/archive/refs/heads"
     downloadStaticUrl="https://github.com/whyour/qinglong-static/archive/refs/heads"
   fi
-  echo -e "使用 ${mirror} 源更新...\n"
+  t '使用 %s 源更新...\n' "${mirror}"
 
   local primary_branch="master"
   if [[ "${QL_BRANCH}" == "develop" ]] || [[ "${QL_BRANCH}" == "debian" ]] || [[ "${QL_BRANCH}" == "debian-dev" ]]; then
@@ -279,13 +279,13 @@ update_qinglong() {
   exit_status=$?
 
   if [[ $exit_status -eq 0 ]]; then
-    echo -e "更新青龙源文件成功...\n"
+    t '更新青龙源文件成功...\n'
 
     unzip -oq ${dir_tmp}/ql.zip -d ${dir_tmp}
 
     update_qinglong_static
   else
-    echo -e "更新青龙源文件失败，请检查网络...\n"
+    t '更新青龙源文件失败，请检查网络...\n'
   fi
 }
 
@@ -294,30 +294,30 @@ update_qinglong_static() {
   exit_status=$?
 
   if [[ $exit_status -eq 0 ]]; then
-    echo -e "更新青龙静态资源成功...\n"
+    t '更新青龙静态资源成功...\n'
     unzip -oq ${dir_tmp}/static.zip -d ${dir_tmp}
 
     check_update_dep
   else
-    echo -e "更新青龙静态资源失败，请检查网络...\n"
+    t '更新青龙静态资源失败，请检查网络...\n'
   fi
 }
 
 check_update_dep() {
-  echo -e "\n开始检测依赖...\n"
+  t '\n开始检测依赖...\n'
   if [[ $(diff $dir_root/package.json ${dir_tmp}/qinglong-${primary_branch}/package.json) ]]; then
     npm_install_2 "${dir_tmp}/qinglong-${primary_branch}"
   fi
 
   if [[ $exit_status -eq 0 ]]; then
-    echo -e "\n依赖检测安装成功...\n"
-    echo -e "更新包下载成功..."
+    t '\n依赖检测安装成功...\n'
+    t '更新包下载成功...\n'
 
     if [[ "$needRestart" == 'true' ]]; then
       reload_qinglong "system"
     fi
   else
-    echo -e "\n依赖检测安装失败，请检查网络...\n"
+    t '\n依赖检测安装失败，请检查网络...\n'
   fi
 }
 
@@ -514,7 +514,7 @@ main() {
     if [[ -n $p2 ]]; then
       update_repo "$p2" "$p3" "$p4" "$p5" "$p6" "$p7" "$p8" "$p9" "$p10"
     else
-      eval echo -e "命令输入错误...\\\n" $cmd
+      t '命令输入错误...\n'
       eval usage $cmd
     fi
     ;;
@@ -523,7 +523,7 @@ main() {
     if [[ -n $p2 ]]; then
       update_raw "$p2" "$p3" "$p4" "$p5"
     else
-      eval echo -e "命令输入错误...\\\n" $cmd
+      t '命令输入错误...\n'
       eval usage $cmd
     fi
     ;;
@@ -549,7 +549,7 @@ main() {
     eval update_auth_config "\\\"username\\\":\\\"$p2\\\"" "重置用户名" $cmd
     ;;
   *)
-    eval echo -e "命令输入错误...\\\n" $cmd
+    t '命令输入错误...\n'
     eval usage $cmd
     ;;
   esac

package/static/build/api/config.js

@@ -33,6 +33,7 @@ const fs = __importStar(require("fs/promises"));
 const celebrate_1 = require("celebrate");
 const path_1 = require("path");
 const const_1 = require("../config/const");
+const i18n_1 = require("../shared/i18n");
 const config_2 = __importDefault(require("../services/config"));
 const utils_1 = require("../shared/utils");
 const route = (0, express_1.Router)();
@@ -84,15 +85,24 @@ exports.default = (app) => {
         const logger = typedi_1.Container.get('logger');
         try {
             const { name, content } = req.body;
-            if (config_1.default.blackFileList.includes(name)) {
-                res.send({ code: 403, message: '文件无法访问' });
-            }
-            let path = (0, path_1.join)(config_1.default.configPath, name);
+            // Resolve path first to prevent traversal attacks
+            let basePath = config_1.default.configPath;
             if (name.startsWith('data/scripts/')) {
-                path = (0, path_1.join)(config_1.default.rootPath, name);
+                basePath = (0, path_1.join)(config_1.default.rootPath, 'data/scripts');
+            }
+            const cleanName = name.replace(/^data\/scripts\//, '');
+            const resolvedPath = (0, path_1.join)(basePath, cleanName);
+            const normalized = (0, path_1.join)(resolvedPath);
+            // Verify the resolved path stays within allowed directory
+            if (!normalized.startsWith(basePath)) {
+                return res.send({ code: 403, message: (0, i18n_1.t)('文件路径无效') });
+            }
+            // Check blacklist on actual filename (not user input)
+            if (config_1.default.blackFileList.includes((0, path_1.basename)(normalized))) {
+                return res.send({ code: 403, message: (0, i18n_1.t)('文件无法访问') });
             }
-            await (0, utils_1.writeFileWithLock)(path, content);
-            res.send({ code: 200, message: '保存成功' });
+            await (0, utils_1.writeFileWithLock)(normalized, content);
+            res.send({ code: 200, message: (0, i18n_1.t)('保存成功') });
         }
         catch (e) {
             return next(e);