Skip to content

fix: sanitize control characters in paths printed on quit - #616

Merged
dundee merged 1 commit into
dundee:masterfrom
carfeii:fix/sanitize-quit-output
Aug 11, 2026
Merged

fix: sanitize control characters in paths printed on quit#616
dundee merged 1 commit into
dundee:masterfrom
carfeii:fix/sanitize-quit-output

Conversation

@carfeii

@carfeii carfeii commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

Fixes #615.

gdu's TUI is built on tview, which already strips control characters from the paths it renders on screen. But two features print a path directly to the terminal after the TUI has already stopped, bypassing that protection: quitting with Q prints the current directory's path, and quitting after marking files prints each marked path. A scanned directory or file's name has no character restrictions, so a crafted name can inject terminal escape sequences into either printed line.

Adds sanitizePathForDisplay (tui/tui.go), replacing control characters with the Unicode replacement character, applied at both doQuit's currentDirPath print (tui/keys.go) and printMarkedPaths (tui/tui.go).

Verified against a directory containing a subdirectory named with a raw OSC title-set escape sequence, navigating into it and quitting with Q, output redirected to a file and inspected as a hex dump. Confirmed no regression with a normal directory path. tui package tests pass.

One honest caveat: I fixed printMarkedPaths using the identical pattern as the confirmed Q-path sink (same unsanitized fmt.Fprintf shape, same sanitizer), but I wasn't able to independently reproduce that specific call site live within the time I had. Marking an entry worked (confirmed via the checkmark in the UI itself), but the raw output capture never showed the expected printed line on quit despite a few timing adjustments on my end. The fix should still be correct by inspection, just flagging that I'm not claiming it as independently reproduced the way the Q path is.

gdu's TUI is built on tview, which already strips control characters
from the paths it renders on screen. But two features print a path
directly to the terminal after the TUI has already stopped, bypassing
that protection: quitting with Q prints the current directory's path,
and quitting after marking files prints each marked path. A scanned
directory or file's name has no character restrictions, so a crafted
name can inject terminal escape sequences into either printed line.

Add sanitizePathForDisplay (tui/tui.go), replacing control characters
with the Unicode replacement character, applied at both doQuit's
currentDirPath print (tui/keys.go) and printMarkedPaths (tui/tui.go).
@codecov

codecov Bot commented Aug 11, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 71.42857% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 85.86%. Comparing base (fe605ec) to head (f1d803d).

Files with missing lines Patch % Lines
tui/tui.go 66.66% 1 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master     #616      +/-   ##
==========================================
- Coverage   85.89%   85.86%   -0.03%     
==========================================
  Files          55       55              
  Lines        6329     6334       +5     
==========================================
+ Hits         5436     5439       +3     
- Misses        689      690       +1     
- Partials      204      205       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@dundee
dundee merged commit 5d76fab into dundee:master Aug 11, 2026
9 checks passed
@dundee

dundee commented Aug 11, 2026

Copy link
Copy Markdown
Owner

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Path printed on quit isn't stripped of terminal escape sequences, allowing injection via a crafted directory name

2 participants