fix: resolve critical issues and improve task management

- Fix path traversal vulnerability in downloadVideo handler by adding
  download directory whitelist validation
- Add graceful shutdown with signal handling for task persistence
- Fix division by zero panic in progressBar.percent() when total <= 0
- Add GetDB() function that returns error instead of using log.Fatal
- Change deleteTask to only remove database records, preserve downloaded files
- Add paused status for interrupted tasks on shutdown

Co-Authored-By: Claude

internal/router/video.go

@@ -133,9 +133,42 @@ func getPopularVideos(w http.ResponseWriter, r *http.Request) {
 
 var downloadVideo = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 	path := r.URL.Query().Get("path")
+	if path == "" {
+		res_error.Send(w, res_error.ParamError)
+		return
+	}
+
+	// 获取下载目录作为白名单
+	db := util.MustGetDB()
+	defer db.Close()
+	downloadFolder, err := util.GetCurrentFolder(db)
+	if err != nil {
+		res_error.Send(w, fmt.Sprintf("获取下载目录失败: %v", err))
+		return
+	}
+
+	// 清理路径并转换为绝对路径
 	safePath := filepath.Clean(path)
-	safePath = strings.ReplaceAll(safePath, "\\", "/")
-	http.ServeFile(w, r, safePath)
+	absPath, err := filepath.Abs(safePath)
+	if err != nil {
+		res_error.Send(w, "无效的文件路径")
+		return
+	}
+
+	// 获取下载目录的绝对路径
+	absDownloadFolder, err := filepath.Abs(downloadFolder)
+	if err != nil {
+		res_error.Send(w, "无效的下载目录")
+		return
+	}
+
+	// 安全检查：确保请求的文件在下载目录内
+	if !strings.HasPrefix(absPath, absDownloadFolder) {
+		res_error.Send(w, "禁止访问该路径")
+		return
+	}
+
+	http.ServeFile(w, r, absPath)
 })
 
 var getSeasonsArchivesListFirstBvid = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -179,4 +212,4 @@ var getFavList = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	util.Res{Success: true, Message: "获取成功", Data: favList}.Write(w)
-})
+})