Location: apps/swiftly/src/FiveStack.Services/EnvironmentService.cs:124 (game-server)
What: Load() parses each .env line with line.Split('=', StringSplitOptions.RemoveEmptyEntries) and then requires parts.Length == 2. Any value that itself contains an '=' produces 3+ parts and the whole line is skipped; a value with a trailing '=' (e.g. base64 padding) yields 2 parts with the trailing segment removed, so the variable is set to a truncated value. There is no count: 2 limit and no rejoining of the remainder. The identical bug exists in the counterstrikesharp EnvironmentService.cs:100.
Impact: A standalone/LAN deployment provides a .env file (one of /serverdata/serverfiles, /csgo, or CWD) with SERVER_API_PASSWORD=ab12cd== (base64-style token ending in '='). Load() sets SERVER_API_PASSWORD to ab12cd (padding stripped). Every subsequent Bearer-authenticated call (GetMatchFromApi, demo pre-sign/upload, ping, the /matches WebSocket Basic auth) uses the wrong secret and is rejected, so the server silently never receives a match assignment and never uploads demos, with no error pointing at the cause. A value with an interior '=' (e.g. a connection string or URL query param) is dropped entirely and the process falls back to defaults.
Suggested fix: Parse with a max-split of 2, e.g. line.Split('=', 2) (without RemoveEmptyEntries), trim only the key, and preserve the full remainder as the value; skip blank/comment lines explicitly.
Verifier evidence
apps/swiftly/src/FiveStack.Services/EnvironmentService.cs:122-131:
foreach (var line in File.ReadAllLines(filePath))
{
var parts = line.Split('=', StringSplitOptions.RemoveEmptyEntries);
if (parts.Length != 2)
{
continue;
}
Environment.SetEnvironmentVariable(parts[0], parts[1]);
}
Consumer at line 52-53: return Environment.GetEnvironmentVariable("SERVER_API_PASSWORD") ?? GetConfig().SERVER_API_PASSWORD;
Twin bug: apps/counterstrikesharp/src/FiveStack.Services/EnvironmentService.cs:100 var parts = line.Split('=', StringSplitOptions.RemoveEmptyEntries);
Found by the 2026-07 multi-agent code audit; adversarially verified (CONFIRMED, P2). One of a batch of findings from that pass.
Location:
apps/swiftly/src/FiveStack.Services/EnvironmentService.cs:124(game-server)What: Load() parses each .env line with
line.Split('=', StringSplitOptions.RemoveEmptyEntries)and then requiresparts.Length == 2. Any value that itself contains an '=' produces 3+ parts and the whole line is skipped; a value with a trailing '=' (e.g. base64 padding) yields 2 parts with the trailing segment removed, so the variable is set to a truncated value. There is nocount: 2limit and no rejoining of the remainder. The identical bug exists in the counterstrikesharp EnvironmentService.cs:100.Impact: A standalone/LAN deployment provides a .env file (one of /serverdata/serverfiles, /csgo, or CWD) with
SERVER_API_PASSWORD=ab12cd==(base64-style token ending in '='). Load() sets SERVER_API_PASSWORD toab12cd(padding stripped). Every subsequent Bearer-authenticated call (GetMatchFromApi, demo pre-sign/upload, ping, the /matches WebSocket Basic auth) uses the wrong secret and is rejected, so the server silently never receives a match assignment and never uploads demos, with no error pointing at the cause. A value with an interior '=' (e.g. a connection string or URL query param) is dropped entirely and the process falls back to defaults.Suggested fix: Parse with a max-split of 2, e.g.
line.Split('=', 2)(without RemoveEmptyEntries), trim only the key, and preserve the full remainder as the value; skip blank/comment lines explicitly.Verifier evidence
apps/swiftly/src/FiveStack.Services/EnvironmentService.cs:122-131:
foreach (var line in File.ReadAllLines(filePath)){var parts = line.Split('=', StringSplitOptions.RemoveEmptyEntries);if (parts.Length != 2){continue;}Environment.SetEnvironmentVariable(parts[0], parts[1]);}Consumer at line 52-53:
return Environment.GetEnvironmentVariable("SERVER_API_PASSWORD") ?? GetConfig().SERVER_API_PASSWORD;Twin bug: apps/counterstrikesharp/src/FiveStack.Services/EnvironmentService.cs:100
var parts = line.Split('=', StringSplitOptions.RemoveEmptyEntries);Found by the 2026-07 multi-agent code audit; adversarially verified (CONFIRMED, P2). One of a batch of findings from that pass.