Skip to content

Sanitize all text before printing - #913

Merged
Leonard Hecker (lhecker) merged 1 commit into
mainfrom
dev/lhecker/sanitize-inputs
Aug 10, 2026
Merged

Sanitize all text before printing#913
Leonard Hecker (lhecker) merged 1 commit into
mainfrom
dev/lhecker/sanitize-inputs

Conversation

@lhecker

@lhecker Leonard Hecker (lhecker) commented Aug 10, 2026

Copy link
Copy Markdown
Member

On UNIX it's possible to create filenames containing arbitrary escape
sequences. To avoid injecting them into stdout, this sanitizes all
output written to the Framebuffer.

use stdext::arena::{self, Arena, scratch_arena};
use stdext::arena_format;
use stdext::collections::{BString, BVec};
use stdext::unicode::sanitize_control_chars;

@lhecker Leonard Hecker (lhecker) Aug 10, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Notes:

  • There are new helpers on BString/BVec to make generics possible (e.g. write!() into a BVec; stdlib has them too). You can mostly ignore those changes.
  • There's now 1 central function to sanitize strings. It's in sanitize.rs at the end and I suggest reading it first.
  • With the sanitizer in place, all of the TextBuffer rendering logic moved into Framebuffer.

@lhecker Leonard Hecker (lhecker) added C-bug It shouldn't be doing this. P-low Low(er) priority. Example: Bugs in less commonly used features. labels Aug 10, 2026
@lhecker
Leonard Hecker (lhecker) merged commit adf09b8 into main Aug 10, 2026
13 checks passed
@lhecker
Leonard Hecker (lhecker) deleted the dev/lhecker/sanitize-inputs branch August 10, 2026 22:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

C-bug It shouldn't be doing this. P-low Low(er) priority. Example: Bugs in less commonly used features.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants