update 2026-06-16 01:07:40

homeproxy/root/usr/share/rpcd/ucode/luci.homeproxy

@@ -1036,7 +1036,7 @@ const methods = {
 			const type = req.args?.type;
 			let result = {};
 
-			const fd = popen('/usr/bin/sing-box generate ' + type + ` ${req.args?.params || ''}`);
+			const fd = popen(`/usr/bin/sing-box generate ${type} ${shellquote(req.args?.params || '')}`);
 			if (fd) {
 				let ech_cfg_set = false;
 				let ech_key_set = false;