systemd generator: newline in configuration value escapes directive and injects unintended unit properties

The systemd generator currently incorporates configuration values from zeek.conf directly into generated systemd unit files. During testing, I found that newline characters inside a configuration value can escape the intended directive and cause the generator to emit an additional systemd directive in the output unit file.

This means configuration data can cross from Zeek’s configuration parser into the trusted systemd unit context without sanitization. The effect depends on who can modify zeek.conf and under which privileges the generator runs, but it allows unexpected systemd properties to appear in the generated service file.

Below is a minimal example that demonstrates the behavior:

Generated unit file excerpt:

User=zeek-test Group=INJECTED

A newline variant produces an unintended extra directive.

It may be worth validating configuration values (e.g., rejecting newline or other control characters) at parse time before they reach the unit generation step.

I am happy to provide more test cases or help evaluate possible fixes.

AI Transparency note: : Used Microsoft Copilot to refine English. All testing and evaluation were performed by me.

Below is the screenshot of the test conducted: