fix: Escape special characters in passwords and credentials for shell commands

Passwords containing special characters like &, $, |, etc. were being
interpreted by the shell instead of being passed as literal values.
Added shellEscape() helper to properly quote values.

backend/src/services/minio.service.js

@@ -11,6 +11,13 @@ const { AppError } = require('../middleware/errorHandler.middleware');
 
 const execAsync = util.promisify(exec);
 
+// Shell escape helper - wraps value in single quotes and escapes internal single quotes
+function shellEscape(value) {
+  if (value === null || value === undefined) return "''";
+  // Replace single quotes with '\'' (end quote, escaped quote, start quote)
+  return `'${String(value).replace(/'/g, "'\\''")}'`;
+}
+
 class MinIOService {
   constructor(alias = config.minio.defaultAlias) {
     this.alias = alias;
@@ -255,9 +262,9 @@ class MinIOService {
       // Create bucket
       await this.createBucket(bucketName);
 
-      // Create user
+      // Create user (escape password for shell safety)
       await this.executeCommand(
-        `mc admin user add ${this.alias} ${username} ${password}`
+        `mc admin user add ${this.alias} ${shellEscape(username)} ${shellEscape(password)}`
       );
 
       // Create policy
@@ -436,8 +443,9 @@ class MinIOService {
       throw new AppError('Invalid alias name', 400);
     }
 
+    // Escape credentials for shell safety
     await this.executeCommand(
-      `mc alias set ${aliasName} ${endpoint} ${accessKey} ${secretKey}`
+      `mc alias set ${shellEscape(aliasName)} ${shellEscape(endpoint)} ${shellEscape(accessKey)} ${shellEscape(secretKey)}`
     );
     
     // Test the connection
@@ -568,9 +576,9 @@ class MinIOService {
       throw new AppError('Invalid alias name', 400);
     }
 
-    // mc alias set overwrites existing alias
+    // mc alias set overwrites existing alias (escape credentials for shell safety)
     await this.executeCommand(
-      `mc alias set ${aliasName} ${endpoint} ${accessKey} ${secretKey}`
+      `mc alias set ${shellEscape(aliasName)} ${shellEscape(endpoint)} ${shellEscape(accessKey)} ${shellEscape(secretKey)}`
     );
 
     const testResult = await this.testConnection(aliasName);