Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Terminal escape sequence injection via malicious HTTP response data

Abierto
  • ¿Algo no está bien?
#1,812 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
48/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Tranquilo
Stack tecnológico
python
Área
cli, security

Línea de trabajo

Empieza leyendo httpie/output/streams.py, especialmente BaseStream.iter, EncodedStream y PrettyStream, y luego sigue cómo httpie/output/writer.py gestiona write_stream y write_stream_with_colors_win. Verifica el comportamiento con la reproducción proporcionada de un servidor malicioso en un TTY. La tarea estará terminada cuando las secuencias de control del terminal se saneen para la salida en TTY, mientras que la salida redirigida siga siendo sin cambios, con cobertura para las cabeceras y el contenido del cuerpo.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Terminal escape sequence injection via HTTP response data

Summary

HTTPie writes HTTP response headers and body content to the terminal without stripping or escaping terminal control sequences. A malicious HTTP server can embed ANSI escape codes or other terminal control characters in response headers or body text, potentially manipulating the user's terminal display, changing the terminal title, injecting clipboard content (on supported terminals), or in worst-case scenarios with vulnerable terminal emulators, executing commands.

Details

When HTTPie renders a response to a TTY, the data flows through output/streams.py and output/writer.py without any sanitization of terminal control characters. While Pygments-based colorization adds its own ANSI escape sequences for syntax highlighting, it does not filter out escape sequences that are already present in the response data.

The relevant code path is:

  1. Response received from server with embedded escape sequences
  2. BaseStream.__iter__() yields header and body chunks (streams.py, line 63)
  3. write_stream() writes chunks directly to the output buffer (writer.py, line 73)
  4. Terminal interprets all embedded escape sequences

Affected locations:

  • httpie/output/streams.py - BaseStream.__iter__(), EncodedStream, PrettyStream
  • httpie/output/writer.py - write_stream(), write_stream_with_colors_win()

Impact

Terminal display manipulation: An attacker controlling a server can overwrite previous terminal output, hide the real response, or display misleading content. For example, a response could clear the screen and display fake content that looks like a different response.

Terminal title/clipboard injection: On terminals that support OSC escape sequences:

  • \x1b]2;text\x07 changes the terminal window title
  • \x1b]52;c;base64\x07 sets clipboard content on some terminals (iTerm2, some xterm configs)

Terminal emulator vulnerabilities: Some terminal emulators have had historical vulnerabilities where specific escape sequences can trigger command execution or file writes (e.g., CVE-2003-0063 for xterm window title reporting, various iTerm2 and Konsole issues).

This is particularly relevant for HTTPie because it's commonly used in security research and API testing, contexts where users frequently interact with untrusted servers.

Reproduction

Start a malicious server:

import http.server

class Handler(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200)
        # Inject terminal title change via header
        self.send_header('X-Custom', '\x1b]2;INJECTED TITLE\x07normal value')
        self.end_headers()
        # Body: clear screen + fake content
        body = '\x1b[2J\x1b[HHTTP/1.1 200 OK\r\nContent-Type: text/plain\r\n\r\nEverything is fine.'
        self.wfile.write(body.encode())

http.server.HTTPServer(('localhost', 9999), Handler).serve_forever()

Then:

http localhost:9999

The terminal title will change, and the real response content will be replaced with fake output.

Suggested Fix

Filter terminal control characters when outputting to a TTY. A conservative approach:

import re

# Match ANSI escape sequences and other control characters
CONTROL_CHAR_RE = re.compile(
    r'[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]'  # C0 control chars (except \t, \n, \r)
    r'|\x1b(?:\[[^a-zA-Z]*[a-zA-Z]'          # CSI sequences
    r'|\][^\x07]*\x07'                         # OSC sequences
    r'|\(.'                                     # charset selection
    r'|.)'                                      # other escape sequences
)

def sanitize_for_terminal(text: str) -> str:
    return CONTROL_CHAR_RE.sub('', text)

Apply this sanitization in the stream output path when env.stdout_isatty is True, but not when output is redirected to a file or pipe (to preserve raw data for scripting).

This could be implemented as a flag (e.g., --raw-terminal to disable sanitization) for users who explicitly want raw output.

Lenguaje dominante
Python
Estrellas
38.6k
Forks
4k
Sin PR fusionados en 30 d

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de httpie/cli

Todos los issues de httpie/cli

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.