Security hardening: prevent code injection and improve error handling

[tomtom215]

Summary

This PR implements comprehensive security hardening across the LyreBird codebase, focusing on preventing code injection vulnerabilities and improving error handling robustness. The changes replace unsafe source commands with safe key=value parsing, add proper JSON escaping, fix arithmetic operations in strict mode, and enhance systemd service security configurations.

Key Changes

Security Improvements

• Code Injection Prevention: Replaced all source commands for loading configuration files with safe key=value parsing that validates variable names and strips quotes

  • lyrebird-updater.sh: Safe parsing of service state marker files
  • lyrebird-alerts.sh: Safe loading of alert configuration with LYREBIRD_ prefix validation
  • lyrebird-diagnostics.sh: Fixed YAML validation to use argument passing instead of string interpolation

• JSON Escaping: Added json_escape() function in lyrebird-alerts.sh to properly escape special characters (backslashes, quotes, newlines, tabs, carriage returns) in all webhook formatters (generic, Discord, Slack)

• Systemd Hardening: Enabled security features in service files:

  • NoNewPrivileges=yes, ProtectHome=yes, PrivateTmp=yes, ProtectSystem=strict
  • Added kernel and control group protection
  • Added memory limits (1G for audio service, 512M for MediaMTX)
  • Fixed log file paths to use consistent naming

Error Handling & Robustness

• Arithmetic Operations: Added || true to all arithmetic increment operations (((var++))) to prevent failures in strict mode (set -e)

  • Applied across all scripts: updater, stream-manager, mic-check, orchestrator, diagnostics, metrics

• Trap Management: Replaced unsafe eval of trap strings with direct trap re-installation in transaction_rollback() to prevent arbitrary code execution

• Process Management:

  • Fixed wait command handling to properly capture exit codes without relying on implicit status
  • Added safe PID reading with validation in stream-manager
  • Improved HTTP code validation with regex check before arithmetic comparison

• Temporary Files:

  • Added secure temp file creation with proper permissions (600) in lyrebird-alerts.sh
  • Added cleanup traps for temp files in generate_mediamtx_config()

• Input Validation:

  • Added numeric validation for heartbeat timestamps to prevent arithmetic crashes on corrupted files
  • Fixed path validation to require trailing slash match preventing false positives
  • Added guards against division by zero in progress bar calculations

Code Quality

• Fixed multiple instances of unsafe string interpolation in Python/Perl commands
• Improved guard clause ordering in lyrebird-common.sh to prevent readonly variable errors on re-sourcing
• Removed unnecessary disown call in spinner function
• Fixed progress bar overflow when current exceeds total
• Improved countdown timer to use arithmetic assignment instead of decrement operator

Implementation Details

• All configuration parsing now uses explicit key validation with regex patterns (e.g., ^[A-Z_][A-Z_0-9]*$)
• JSON escaping is centralized in a single function for consistency
• Arithmetic operations are made safe for use with set -e without changing script behavior
• Trap restoration uses explicit function calls instead of eval to prevent code injection
• All temporary files are created with restrictive permissions and proper cleanup handlers

https://claude.ai/code/session_01VLuWBVjLP54eb8sJx5VSXv