chore: secure fix

internal/services/tasks/executor_service.go

@@ -510,7 +510,7 @@ func (es *ExecutorService) AddCronTask(task *models.Task) error {
 		return nil
 	}
 	// 在加入调度器前，预先加载好环境信息
-	task.RuntimeEnvs, _ = es.loadEnvVars(task.ID, string(task.Envs))
+	task.RuntimeEnvs, task.RuntimeSecrets = es.loadEnvVars(task.ID, string(task.Envs))
 
 	return es.cronManager.AddTask(task)
 }
@@ -997,11 +997,10 @@ func (es *ExecutorService) BuildRepoCommand(task *models.Task) (string, string)
 	// 为了防止 shell 解释特殊字符（如 |），对每个参数进行转义/加引号
 	quotedArgs := make([]string, len(args))
 	for i, arg := range args {
-		// 使用单引号包裹参数，并转义已有的单引号
-		quotedArgs[i] = "'" + strings.ReplaceAll(arg, "'", "'\\''") + "'"
+		quotedArgs[i] = utils.QuotePath(arg)
 	}
 
-	cmdStr := "'" + strings.ReplaceAll(exePath, "'", "'\\''") + "' " + strings.Join(quotedArgs, " ")
+	cmdStr := utils.QuotePath(exePath) + " " + strings.Join(quotedArgs, " ")
 	return buildRepoCommandEnvPrefix()+cmdStr, filepath.Dir(exePath)
 }
 

internal/services/tasks/ql_repo_parser.go

@@ -403,17 +403,18 @@ func isDir(path string) bool {
 }
 
 func getCommandByExt(ext, path string) string {
+	quotedPath := utils.QuotePath(path)
 	switch ext {
 	case ".js", ".ts":
-		return fmt.Sprintf("node %s", path)
+		return fmt.Sprintf("node %s", quotedPath)
 	case ".py":
-		return fmt.Sprintf("python %s", path)
+		return fmt.Sprintf("python %s", quotedPath)
 	case ".sh":
-		return fmt.Sprintf("bash %s", path)
+		return fmt.Sprintf("bash %s", quotedPath)
 	case ".php":
-		return fmt.Sprintf("php %s", path)
+		return fmt.Sprintf("php %s", quotedPath)
 	}
-	return path
+	return quotedPath
 }
 
 func matchesQLPattern(rel, filename string, keywordsStr string) bool {
@@ -468,3 +469,8 @@ func splitKeywords(s string) []string {
 	}
 	return res
 }
+
+func resolveAbsScriptsDir() string {
+	cwd, _ := os.Getwd()
+	return filepath.Join(cwd, "data", "scripts")
+}