Довёл до прода интеграцию Hysteria2: безопасный URI, тесты, актуализация доков и hardening env

orchestrator/src/config/env.ts

@@ -143,6 +143,14 @@ function normalizeFixedHysteriaObfsType(value: string | undefined): "salamander"
   return "salamander";
 }
 
+function normalizeYamlSafeSecret(name: string, value: string): string {
+  const v = requireValue(name, value);
+  if (/["\n\r]/.test(v)) {
+    throw new Error(`${name} contains forbidden characters for HY2XS YAML profile`);
+  }
+  return v;
+}
+
 function normalizeSafeAbsolutePath(name: string, value: string, options?: { disallowTmp?: boolean }): string {
   const v = value.trim();
   if (!v.startsWith("/")) {
@@ -205,9 +213,15 @@ export function parseRuntimeEnv(content: string): RuntimeConfig {
       env.HY2XS_HYSTERIA_TRAFFIC_STATS_HOST || "127.0.0.1"
     ),
     hysteriaTrafficStatsPort: trafficStatsPort,
-    hysteriaTrafficStatsSecret: valueOrGenerate(env.HY2XS_HYSTERIA_TRAFFIC_STATS_SECRET),
+    hysteriaTrafficStatsSecret: normalizeYamlSafeSecret(
+      "HY2XS_HYSTERIA_TRAFFIC_STATS_SECRET",
+      valueOrGenerate(env.HY2XS_HYSTERIA_TRAFFIC_STATS_SECRET)
+    ),
     hysteriaObfsType,
-    hysteriaObfsPassword: requireValue("HY2XS_HYSTERIA_OBFS_PASSWORD", valueOrGenerate(env.HY2XS_HYSTERIA_OBFS_PASSWORD)),
+    hysteriaObfsPassword: normalizeYamlSafeSecret(
+      "HY2XS_HYSTERIA_OBFS_PASSWORD",
+      valueOrGenerate(env.HY2XS_HYSTERIA_OBFS_PASSWORD)
+    ),
     hysteriaBandwidthUp: env.HY2XS_HYSTERIA_BANDWIDTH_UP || "50 mbps",
     hysteriaBandwidthDown: env.HY2XS_HYSTERIA_BANDWIDTH_DOWN || "50 mbps",
     hysteriaIgnoreClientBandwidth: parseBool(