adam/Remote-Terminal-for-MeshCore
1
0 Fork 0
mirror of https://github.com/jkingsman/Remote-Terminal-for-MeshCore.git synced 2026-11-03 08:02:19 +01:00
Code Issues 26 Packages Projects Releases Wiki Activity

$ in basic auth password is silently mangled by service installer #113

New Issue
Closed
opened 2026-10-05 01:57:42 +02:00 by adam · 1 comment
adam commented 2026-10-05 01:57:42 +02:00
Owner
Copy link
Copy source

(Thank you for this project! It's awesome. I noticed this when deploying. Here's what Claude found.)

The systemd service installer (scripts/setup/install_service.sh) doesn't support $ characters in MESHCORE_BASIC_AUTH_PASSWORD. Passwords containing $ get silently truncated or corrupted.

What happens

The password is written directly into the unit file on line 323:

echo "Environment=MESHCORE_BASIC_AUTH_PASSWORD=${AUTH_PASSWORD}"

Systemd treats $ as a special character for variable substitution in unit files. A password like p@ss$word gets written as-is, but systemd interprets $word as a variable reference (resolving to empty string), so the app receives p@ss instead.

Expected behavior

Passwords with $ should work correctly, or the installer should warn that $ isn't supported.

Fix

Escape $ as $$ before writing to the unit file (the systemd escape for a literal dollar sign):

ESCAPED_PASSWORD="${AUTH_PASSWORD//\$/\$\$}"
echo "Environment=MESHCORE_BASIC_AUTH_PASSWORD=${ESCAPED_PASSWORD}"

The same issue applies to MESHCORE_BASIC_AUTH_USERNAME (line 322) and MESHCORE_BLE_PIN (line 311) — any user-supplied value written into the unit file could contain $.

(Thank you for this project! It's awesome. I noticed this when deploying. Here's what Claude found.) The systemd service installer (`scripts/setup/install_service.sh`) doesn't support `$` characters in `MESHCORE_BASIC_AUTH_PASSWORD`. Passwords containing `$` get silently truncated or corrupted. ## What happens The password is written directly into the unit file on line 323: ```bash echo "Environment=MESHCORE_BASIC_AUTH_PASSWORD=${AUTH_PASSWORD}" ``` Systemd treats `$` as a special character for variable substitution in unit files. A password like `p@ss$word` gets written as-is, but systemd interprets `$word` as a variable reference (resolving to empty string), so the app receives `p@ss` instead. ## Expected behavior Passwords with `$` should work correctly, or the installer should warn that `$` isn't supported. ## Fix Escape `$` as `$$` before writing to the unit file (the systemd escape for a literal dollar sign): ```bash ESCAPED_PASSWORD="${AUTH_PASSWORD//\$/\$\$}" echo "Environment=MESHCORE_BASIC_AUTH_PASSWORD=${ESCAPED_PASSWORD}" ``` The same issue applies to `MESHCORE_BASIC_AUTH_USERNAME` (line 322) and `MESHCORE_BLE_PIN` (line 311) — any user-supplied value written into the unit file could contain `$`. <!-- github-sync-id:4204953663 -->
adam closed this issue 2026-10-05 01:57:42 +02:00
adam commented 2026-10-05 01:57:43 +02:00
Author
Owner
Copy link
Copy source

lol I KNEW this was gonna be so hairy. Thanks for the bug report.

lol I KNEW this was gonna be so hairy. Thanks for the bug report. <!-- github-comment-id:4187454618 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Remote-Terminal-for-MeshCore#113