Terminal escape sequence injection via malicious HTTP response data

先阅读 httpie/output/streams.py，尤其是 BaseStream.iter、EncodedStream 和 PrettyStream，然后跟踪 httpie/output/writer.py 如何处理 write_stream 和 write_stream_with_colors_win。使用提供的恶意服务器复现，在 TTY 中验证行为。完成标准是：TTY 输出中的终端控制序列会被清理，而重定向输出仍保持原始状态，并且对 header 和 body 内容都有覆盖。

Terminal escape sequence injection via HTTP response data

Summary

HTTPie writes HTTP response headers and body content to the terminal without stripping or escaping terminal control sequences. A malicious HTTP server can embed ANSI escape codes or other terminal control characters in response headers or body text, potentially manipulating the user's terminal display, changing the terminal title, injecting clipboard content (on supported terminals), or in worst-case scenarios with vulnerable terminal emulators, executing commands.

Details

When HTTPie renders a response to a TTY, the data flows through output/streams.py and output/writer.py without any sanitization of terminal control characters. While Pygments-based colorization adds its own ANSI escape sequences for syntax highlighting, it does not filter out escape sequences that are already present in the response data.

The relevant code path is:

1. Response received from server with embedded escape sequences
2. BaseStream.__iter__() yields header and body chunks (streams.py, line 63)
3. write_stream() writes chunks directly to the output buffer (writer.py, line 73)
4. Terminal interprets all embedded escape sequences

Affected locations:

• httpie/output/streams.py - BaseStream.__iter__(), EncodedStream, PrettyStream
• httpie/output/writer.py - write_stream(), write_stream_with_colors_win()

Impact

Terminal display manipulation: An attacker controlling a server can overwrite previous terminal output, hide the real response, or display misleading content. For example, a response could clear the screen and display fake content that looks like a different response.

Terminal title/clipboard injection: On terminals that support OSC escape sequences:

• \x1b]2;text\x07 changes the terminal window title
• \x1b]52;c;base64\x07 sets clipboard content on some terminals (iTerm2, some xterm configs)

Terminal emulator vulnerabilities: Some terminal emulators have had historical vulnerabilities where specific escape sequences can trigger command execution or file writes (e.g., CVE-2003-0063 for xterm window title reporting, various iTerm2 and Konsole issues).

This is particularly relevant for HTTPie because it's commonly used in security research and API testing, contexts where users frequently interact with untrusted servers.

Reproduction

Start a malicious server:

import http.server

class Handler(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200)
        # Inject terminal title change via header
        self.send_header('X-Custom', '\x1b]2;INJECTED TITLE\x07normal value')
        self.end_headers()
        # Body: clear screen + fake content
        body = '\x1b[2J\x1b[HHTTP/1.1 200 OK\r\nContent-Type: text/plain\r\n\r\nEverything is fine.'
        self.wfile.write(body.encode())

http.server.HTTPServer(('localhost', 9999), Handler).serve_forever()

Then:

http localhost:9999

The terminal title will change, and the real response content will be replaced with fake output.

Suggested Fix

Filter terminal control characters when outputting to a TTY. A conservative approach:

import re

# Match ANSI escape sequences and other control characters
CONTROL_CHAR_RE = re.compile(
    r'[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]'  # C0 control chars (except \t, \n, \r)
    r'|\x1b(?:\[[^a-zA-Z]*[a-zA-Z]'          # CSI sequences
    r'|\][^\x07]*\x07'                         # OSC sequences
    r'|\(.'                                     # charset selection
    r'|.)'                                      # other escape sequences
)

def sanitize_for_terminal(text: str) -> str:
    return CONTROL_CHAR_RE.sub('', text)

Apply this sanitization in the stream output path when env.stdout_isatty is True, but not when output is redirected to a file or pipe (to preserve raw data for scripting).

This could be implemented as a flag (e.g., --raw-terminal to disable sanitization) for users who explicitly want raw output.