Усилен firewall rollback lifecycle и безопасная запись конфигов/секретов

orchestrator/src/config/env.ts

@@ -112,6 +112,26 @@ function normalizeAcmeType(value: string): "http" | "tls" | "dns" {
   throw new Error(`invalid HY2XS_ACME_TYPE: ${value}`);
 }
 
+function normalizeSafeAbsolutePath(name: string, value: string, options?: { disallowTmp?: boolean }): string {
+  const v = value.trim();
+  if (!v.startsWith("/")) {
+    throw new Error(`${name} must be an absolute path`);
+  }
+  if (v === "/") {
+    throw new Error(`${name} must not be /`);
+  }
+  if (v.includes("\0") || /[\r\n]/.test(v)) {
+    throw new Error(`${name} contains forbidden control characters`);
+  }
+  if (/[;&|`$<>]/.test(v)) {
+    throw new Error(`${name} contains forbidden shell control characters`);
+  }
+  if (options?.disallowTmp && (v === "/tmp" || v.startsWith("/tmp/"))) {
+    throw new Error(`${name} must not be under /tmp`);
+  }
+  return v;
+}
+
 export function parseRuntimeEnv(content: string): RuntimeConfig {
   const env = parseEnv(content);
 
@@ -142,8 +162,8 @@ export function parseRuntimeEnv(content: string): RuntimeConfig {
     tlsMode,
     acmeType,
     acmeEmail: env.HY2XS_ACME_EMAIL || "",
-    tlsCertPath: env.HY2XS_TLS_CERT_PATH || "/etc/hysteria/server.crt",
-    tlsKeyPath: env.HY2XS_TLS_KEY_PATH || "/etc/hysteria/server.key",
+    tlsCertPath: normalizeSafeAbsolutePath("HY2XS_TLS_CERT_PATH", env.HY2XS_TLS_CERT_PATH || "/etc/hysteria/server.crt"),
+    tlsKeyPath: normalizeSafeAbsolutePath("HY2XS_TLS_KEY_PATH", env.HY2XS_TLS_KEY_PATH || "/etc/hysteria/server.key"),
     hysteriaBindHost: normalizeIpv4Host("HY2XS_HYSTERIA_BIND_HOST", env.HY2XS_HYSTERIA_BIND_HOST || "0.0.0.0"),
     hysteriaPort,
     hysteriaAuthMode: "http",
@@ -162,10 +182,10 @@ export function parseRuntimeEnv(content: string): RuntimeConfig {
       env.HY2XS_HYSTERIA_IGNORE_CLIENT_BANDWIDTH,
       false
     ),
-    hysteriaConfigPath: env.HY2XS_HYSTERIA_CONFIG_PATH || "/etc/hysteria/config.yaml",
-    installDir: env.HY2XS_INSTALL_DIR || "/opt/hy2xs-admin",
-    dataDir: env.HY2XS_DATA_DIR || "/var/lib/hy2xs-admin",
-    logDir: env.HY2XS_LOG_DIR || "/var/log/hy2xs",
+    hysteriaConfigPath: normalizeSafeAbsolutePath("HY2XS_HYSTERIA_CONFIG_PATH", env.HY2XS_HYSTERIA_CONFIG_PATH || "/etc/hysteria/config.yaml"),
+    installDir: normalizeSafeAbsolutePath("HY2XS_INSTALL_DIR", env.HY2XS_INSTALL_DIR || "/opt/hy2xs-admin", { disallowTmp: true }),
+    dataDir: normalizeSafeAbsolutePath("HY2XS_DATA_DIR", env.HY2XS_DATA_DIR || "/var/lib/hy2xs-admin", { disallowTmp: true }),
+    logDir: normalizeSafeAbsolutePath("HY2XS_LOG_DIR", env.HY2XS_LOG_DIR || "/var/log/hy2xs", { disallowTmp: true }),
     bootstrapAdminSecretPath: "/etc/hy2xs/bootstrap-admin.secret"
   };