From dae89fca31ee975f73f4cab500f5d8e8d4ec347d Mon Sep 17 00:00:00 2001
From: zaphod-black <cade@zbware.com>
Date: Sat, 1 Nov 2025 18:27:20 -0500
Subject: [PATCH] Add defensive newline filtering when writing passwords to
 config
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CRITICAL FIX: Added robust newline stripping as a defensive measure
when writing passwords to the config file.

The Problem:
Even though prompt_password() was fixed to output to stderr, the
newline was still somehow getting into the PBS_PASSWORD variable
in some cases, causing the config file to be malformed.

The Solution (Defense in Depth):
Before writing PBS_PASSWORD to config file, explicitly strip all
newline and carriage return characters:

PBS_PASSWORD_CLEAN=$(echo -n "$PBS_PASSWORD" | tr -d '\n\r')

This ensures the password is always clean, regardless of how it
was captured or what's in the original variable.

Changes:
- pbs-client-installer.sh:
  - Line 298: Added newline filter in reconfigure_connection()
  - Line 593: Added newline filter in create_systemd_service()
  - Both use: tr -d '\n\r' to remove \n and \r characters

CHANGELOG.md:
- Updated to document defensive filtering approach
- Lists both functions that apply the filter

This is a belt-and-suspenders approach: we fix the source
(prompt_password) AND filter at write time for maximum safety.

Impact:
Config file will now ALWAYS have single-line passwords, even if
something goes wrong with password capture. This prevents the
"authentication failed - invalid credentials" error in the
backup service.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 CHANGELOG.md            |  3 +++
 pbs-client-installer.sh | 13 ++++++++++---
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 97fe533..a263a91 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -50,8 +50,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - This was the root cause of "authentication hanging" issues
 - **CRITICAL**: Password/token capture no longer includes newline character
   - `prompt_password()` function now outputs formatting to stderr
+  - Added defensive newline stripping when writing config file
+  - Filters `\n` and `\r` characters from passwords using `tr -d '\n\r'`
   - Fixes "authentication failed - invalid credentials" in backup service
   - Config file now has properly formatted single-line passwords
+  - Applied to both `reconfigure_connection()` and `create_systemd_service()`
 - Script no longer hangs indefinitely when PBS server is unreachable
 - Block device auto-detection now correctly handles btrfs subvolumes
 - Invalid device paths like `/dev/mapper/root[/@]` are now properly cleaned
diff --git a/pbs-client-installer.sh b/pbs-client-installer.sh
index e7af36a..fdc5af9 100755
--- a/pbs-client-installer.sh
+++ b/pbs-client-installer.sh
@@ -293,10 +293,14 @@ reconfigure_connection() {
 
     # Update config file with new connection details
     log "Updating configuration file..."
+
+    # Strip any trailing newlines from password (defensive fix)
+    PBS_PASSWORD_CLEAN=$(echo -n "$PBS_PASSWORD" | tr -d '\n\r')
+
     cat > "$CONFIG_DIR/config" <<EOF
 # PBS Client Configuration
 PBS_REPOSITORY="${PBS_REPOSITORY}"
-PBS_PASSWORD="${PBS_PASSWORD}"
+PBS_PASSWORD="${PBS_PASSWORD_CLEAN}"
 BACKUP_TYPE="${BACKUP_TYPE}"
 BACKUP_PATHS="${BACKUP_PATHS}"
 EXCLUDE_PATTERNS="${EXCLUDE_PATTERNS}"
@@ -584,12 +588,15 @@ create_systemd_service() {
     
     # Create config directory
     mkdir -p "$CONFIG_DIR"
-    
+
+    # Strip any trailing newlines from password (defensive fix)
+    PBS_PASSWORD_CLEAN=$(echo -n "$PBS_PASSWORD" | tr -d '\n\r')
+
     # Save configuration
     cat > "$CONFIG_DIR/config" <<EOF
 # PBS Client Configuration
 PBS_REPOSITORY="${PBS_REPOSITORY}"
-PBS_PASSWORD="${PBS_PASSWORD}"
+PBS_PASSWORD="${PBS_PASSWORD_CLEAN}"
 BACKUP_TYPE="${BACKUP_TYPE}"
 BACKUP_PATHS="${BACKUP_PATHS}"
 EXCLUDE_PATTERNS="${EXCLUDE_PATTERNS}"