From a62f26ba4a92b107640f4ca30d139c504c53c426 Mon Sep 17 00:00:00 2001
From: mwiegand <martin.wiegand@seibert.group>
Date: Fri, 8 May 2026 16:20:10 +0200
Subject: [PATCH] fix(l4d2-web): normalize CRLF to LF in script overlay POST
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

HTML <textarea> form submission encodes line breaks as CRLF per spec.
Storing those CRLFs unchanged means every line of the script reaches
bash with a trailing \r, which bash treats as part of the argument —
turning "ls /" into "ls /\r" and failing. Normalize CRLF/CR → LF in the
/overlays/{id}/script handler so storage and the sandbox tmpfile are
LF-only.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 l4d2web/routes/overlay_routes.py            |  6 +++++-
 l4d2web/tests/test_script_overlay_routes.py | 17 +++++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/l4d2web/routes/overlay_routes.py b/l4d2web/routes/overlay_routes.py
index 6a8ac5f..2d1d1a4 100644
--- a/l4d2web/routes/overlay_routes.py
+++ b/l4d2web/routes/overlay_routes.py
@@ -145,7 +145,11 @@ def _load_script_overlay(db, overlay_id: int, user) -> tuple[Overlay | None, Res
 def update_script(overlay_id: int) -> Response:
     user = current_user()
     assert user is not None
-    script_text = request.form.get("script", "")
+    # HTML form submission of <textarea> uses CRLF line endings per spec; bash
+    # treats the trailing \r as part of each argument and breaks every command.
+    # Normalize to LF before storage so the script is well-formed when written
+    # to the sandbox tmpfile.
+    script_text = request.form.get("script", "").replace("\r\n", "\n").replace("\r", "\n")
     with session_scope() as db:
         overlay, err = _load_script_overlay(db, overlay_id, user)
         if err is not None:
diff --git a/l4d2web/tests/test_script_overlay_routes.py b/l4d2web/tests/test_script_overlay_routes.py
index d54f361..e4ccc17 100644
--- a/l4d2web/tests/test_script_overlay_routes.py
+++ b/l4d2web/tests/test_script_overlay_routes.py
@@ -139,6 +139,23 @@ def test_update_script_body_enqueues_build(app, alice_id) -> None:
         assert len(jobs) == 1
 
 
+def test_update_script_normalizes_crlf_to_lf(app, alice_id) -> None:
+    """HTML <textarea> submits CRLF line endings; bash chokes on trailing \\r
+    in every command. Storage must be LF-only so the sandbox tmpfile is
+    well-formed."""
+    overlay_id = _create_script_overlay(app, alice_id)
+    client = _client_for(app, alice_id)
+    client.post(
+        f"/overlays/{overlay_id}/script",
+        data={"script": "ls /\r\necho hello\r\n"},
+        headers={"X-CSRF-Token": "test-token"},
+    )
+    with session_scope() as s:
+        overlay = s.query(Overlay).filter_by(id=overlay_id).one()
+        assert overlay.script == "ls /\necho hello\n"
+        assert "\r" not in overlay.script
+
+
 def test_manual_rebuild(app, alice_id) -> None:
     overlay_id = _create_script_overlay(app, alice_id)
     client = _client_for(app, alice_id)