[P2] Define safe plain-text handling of terminal control characters
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 55/100
Research direction
Start with src/TermBlade.Core/Buffer/CellBuffer.cs and the rendering paths in src/TermBlade.Core/Rendering/Renderer.cs and src/TermBlade.Core/Rendering/CliRenderer.cs; trace how plain-text cells reach captured output. Define and test a safe policy for user-supplied control characters while keeping intentional framework ANSI generation separate. Done means captured plain-text output emits no user-supplied control bytes and the separate ANSI behavior remains tested.
Written by the indexing model from the issue text.
Description
Audit of main at 33775b35ce39b259cc6a4ea33db6216aba19d702 on 2026-10-08. Priority P2; area: Security.
Problem
Plain-text cells accept C0 control characters and render them directly to the host terminal. Untrusted file/CSV/display text can therefore trigger terminal actions rather than remain inert text.
Evidence / reproduction
DrawText("\a",...) followed by Renderer.Render emits a literal BEL (raw BEL=True). ESC, carriage return and other control scalars also lack validation at SetCell/DrawText. The audit demonstrates control-character emission, not arbitrary remote code execution or a complete OSC exploit.
Source: src/TermBlade.Core/Buffer/CellBuffer.cs:123, src/TermBlade.Core/Rendering/Renderer.cs:173, src/TermBlade.Core/Rendering/CliRenderer.cs:541.
Suggested change
Define a safe plain-text scalar policy and escape/replace controls in display paths. Keep any intentional raw-ANSI output as a clearly separate trusted API; handle tabs/newlines through layout rather than embedded control cells.
Acceptance criteria
- Captured output never emits user-supplied control bytes from plain-text cells.
- Untrusted filenames/CSV fields preserve surrounding terminal content.
- Intentional framework ANSI generation continues to work and is tested separately.
- Dominant language
- C#
- Stars
- 1
- Forks
- 0
- Avg merge
- 3d 7h
- Merged PRs (30d)
- 2
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from evilz/TermBlade
-
documentation
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
documentation
Difficulty 3/5 1-2 days Newbie friendliness 76/100
-
codex
Difficulty 5/5 Over a week Newbie friendliness 25/100
Similar issues
-
[BUG] Still libmicrohttpd dependency is not removed properly from External-Dependency-Info.txt fileOpentype/bug
Difficulty 1/5 Under an hour Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
[辞書] かんそうりつ->乾燥率Open辞書
Difficulty 1/5 Under an hour Newbie friendliness 62/100
Maintainers usually reply within 1 day
-
bug good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
thomhurst/TUnit#7201 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
ArduPilot/MissionPlanner#3826 ·
Maintainers usually reply within 1 day
-
MongoDB integration tests fail on newer GitHub Actions runner kernelsPossibly taken @nmummau claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
Eventuous/eventuous#626 · 2 comments ·
Maintainers usually reply within 7 days