feat(Validators): add server ID validation function to prevent path traversal and unsafe characters; update routes to utilize new validation logic

backend/routes/mikrotikConfigRoutes.js

@@ -236,7 +236,7 @@ async function testMikrotikConnection(req, res) {
     const client = createRosClient(creds);
     await client.print('system/resource');
 
-    return sendOk(res, { ok: true, message: 'Connection successful' });
+    return res.json({ ok: true, message: 'Connection successful' });
   } catch (error) {
     const msg = error.response?.data?.message || error.message || 'Connection failed';
     const status = error.response?.status;
@@ -1302,12 +1302,18 @@ async function speedTestViaTunnel(req, res) {
  * POST /api/mikrotik/run-script
  * Body: { serverId, script?: string } — по умолчанию script=update_bgp_filter
  */
+const SCRIPT_NAME_REGEX = /^[a-zA-Z0-9_-]{1,64}$/;
+
 async function runScript(req, res) {
   try {
     const { serverId, script = 'update_bgp_filter' } = req.body || {};
     if (!serverId) {
       return sendError(res, 400, 'serverId is required', 'E_BAD_REQUEST');
     }
+    const scriptStr = String(script).trim();
+    if (!SCRIPT_NAME_REGEX.test(scriptStr)) {
+      return sendError(res, 400, 'script: only alphanumeric, underscore, hyphen, max 64 chars', 'E_BAD_REQUEST');
+    }
 
     const servers = await readServersFromS3();
     const server = servers.find(s => (s.id || s.dns || s.ip) === serverId);
@@ -1324,11 +1330,11 @@ async function runScript(req, res) {
     // Сначала находим скрипт по имени, затем запускаем по .id
     const scripts = await client.print('system/script');
     const list = Array.isArray(scripts?.data) ? scripts.data : (scripts?.data ? [scripts.data] : []);
-    const found = list.find(s => (s.name || s['.id']) === script);
-    const scriptId = found ? (found['.id'] || found.name) : script;
+    const found = list.find(s => (s.name || s['.id']) === scriptStr);
+    const scriptId = found ? (found['.id'] || found.name) : scriptStr;
     await client.command('system/script/run', { '.id': scriptId });
 
-    return sendOk(res, { ok: true, message: `Скрипт ${script} запущен` });
+    return res.json({ ok: true, message: `Скрипт ${scriptStr} запущен` });
   } catch (error) {
     const msg = error.response?.data?.message || error.message || 'Ошибка запуска скрипта';
     const status = error.response?.status;