修复 frps/frpc TOML 配置注入：新增 protocol.TOMLQuote 并在两处配置渲染全部使用

Result: {"status":"keep","total_issues":8,"eslint_errors":0,"eslint_problems":0,"eslint_warnings":0,"golint_canonicalheader":0,"golint_errname":0,"golint_errorlint":1,"golint_exhaustive":0,"golint_forcetypeassert":0,"golint_gosec":0,"golint_intrange":0,"golint_modernize":3,"golint_nilnil":3,"golint_perfsprint":0,"golint_prealloc":0,"golint_recvcheck":1,"golint_test_testifylint":0,"golint_test_thelper":0,"golint_test_total":0,"golint_test_usetesting":0,"golint_total":8,"golint_usestdlibvars":0,"golint_vetx_total":0,"golint_wastedassign":0,"measure_s":77,"tsc_errors":0,"vitest_failed":0,"vitest_total":126}

pkg/protocol/toml.go

@@ -0,0 +1,34 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package protocol
+
+import "strings"
+
+// TOMLQuote renders s as a quoted TOML basic string, escaping characters that
+// would otherwise break the document or allow key injection (quotes,
+// backslashes, control/newline characters). Use it for every interpolated
+// value written into frps/frpc TOML configs.
+func TOMLQuote(s string) string {
+	var b strings.Builder
+	b.WriteByte('"')
+	for _, r := range s {
+		switch r {
+		case '\\':
+			b.WriteString(`\\`)
+		case '"':
+			b.WriteString(`\"`)
+		case '\n':
+			b.WriteString(`\n`)
+		case '\r':
+			b.WriteString(`\r`)
+		case '\t':
+			b.WriteString(`\t`)
+		default:
+			b.WriteRune(r)
+		}
+	}
+	b.WriteByte('"')
+	return b.String()
+}
+

pkg/protocol/toml_test.go

@@ -0,0 +1,22 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package protocol
+
+import "testing"
+
+func TestTOMLQuote(t *testing.T) {
+	cases := map[string]string{
+		`plain`:         `"plain"`,
+		`a"b`:           `"a\"b"`,
+		`a\b`:           `"a\\b"`,
+		"injection\"\n": `"injection\"\n"`,
+		"":              `""`,
+		"a\tb":          `"a\tb"`,
+	}
+	for in, want := range cases {
+		if got := TOMLQuote(in); got != want {
+			t.Errorf("TOMLQuote(%q) = %q, want %q", in, got, want)
+		}
+	}
+}