fix(credentials): strip CR/LF from values to prevent INI injection

[lxcario]

What

When the credentials file is serialized, a field value containing a newline (CR/LF) is written across multiple lines. Because the file is INI-style (key = value), an embedded newline lets an attacker inject arbitrary key/value pairs -- or a whole new section header -- into the credentials file.

Why it matters

A valid API key or endpoint URL never contains a newline. But a value that reaches serialization from a compromised environment variable or a MITM'd backend response could smuggle a newline and override the stored api_key that is read back on the next invocation. This is a write-path hardening for a security-sensitive file.

Fix

In serializeCredentials, strip CR/LF from every value before writing it, and skip the field if stripping empties it. IP/URL/key values are unaffected; only embedded newlines are removed.

Tests

Added regression tests to src/lib/credentials.test.ts covering values with embedded \n, \r, and \r\n -- asserting the serialized output stays single-line-per-field and round-trips without injected keys. Fail on main before the fix, pass after.

Local run: the only failing credentials tests are the pre-existing Windows-only ones (file mode 0600 -> 0666 and the ~ path check); they pass on Linux CI. typecheck + prettier clean.

Summary by CodeRabbit

• Bug Fixes

  • Credential serialization now removes newline characters from saved values, helping prevent malformed output and injection issues.
  • Empty values created by sanitization are skipped instead of being written.

• Tests

  • Added coverage for credential serialization cases involving embedded line breaks to verify sanitized output remains valid.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 21975cd3-3aa5-4ad6-bdea-69ca627aabcb

📥 Commits

Reviewing files that changed from the base of the PR and between 3ab8136 and 54def97.

📒 Files selected for processing (2)

• src/lib/credentials.test.ts
• src/lib/credentials.ts

---

📝 Walkthrough

Walkthrough

The change sanitizes credential values in serializeCredentials by stripping carriage return and newline characters before writing them to INI output, skipping fields that become empty after sanitization. Two new tests validate protection against newline and CRLF injection.

Changes

Credential Serialization Sanitization

Layer / File(s)	Summary
Sanitize serialized values and add injection tests src/lib/credentials.ts, src/lib/credentials.test.ts	Values are stripped of \r/\n before being written as INI lines, with empty sanitized fields skipped; tests confirm injected newline/CRLF payloads cannot create spurious INI sections or keys.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: stripping CR/LF from credential values to prevent INI injection.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[zeshi-du]

Reviewed and verified — merging. Thanks for the contribution!