fix: sanitize control characters in paths printed on quit - #616
Merged
Conversation
gdu's TUI is built on tview, which already strips control characters from the paths it renders on screen. But two features print a path directly to the terminal after the TUI has already stopped, bypassing that protection: quitting with Q prints the current directory's path, and quitting after marking files prints each marked path. A scanned directory or file's name has no character restrictions, so a crafted name can inject terminal escape sequences into either printed line. Add sanitizePathForDisplay (tui/tui.go), replacing control characters with the Unicode replacement character, applied at both doQuit's currentDirPath print (tui/keys.go) and printMarkedPaths (tui/tui.go).
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #616 +/- ##
==========================================
- Coverage 85.89% 85.86% -0.03%
==========================================
Files 55 55
Lines 6329 6334 +5
==========================================
+ Hits 5436 5439 +3
- Misses 689 690 +1
- Partials 204 205 +1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
dundee
approved these changes
Aug 11, 2026
Owner
|
Thanks! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #615.
gdu's TUI is built on tview, which already strips control characters from the paths it renders on screen. But two features print a path directly to the terminal after the TUI has already stopped, bypassing that protection: quitting with
Qprints the current directory's path, and quitting after marking files prints each marked path. A scanned directory or file's name has no character restrictions, so a crafted name can inject terminal escape sequences into either printed line.Adds
sanitizePathForDisplay(tui/tui.go), replacing control characters with the Unicode replacement character, applied at bothdoQuit's currentDirPath print (tui/keys.go) andprintMarkedPaths(tui/tui.go).Verified against a directory containing a subdirectory named with a raw OSC title-set escape sequence, navigating into it and quitting with
Q, output redirected to a file and inspected as a hex dump. Confirmed no regression with a normal directory path.tuipackage tests pass.One honest caveat: I fixed
printMarkedPathsusing the identical pattern as the confirmedQ-path sink (same unsanitizedfmt.Fprintfshape, same sanitizer), but I wasn't able to independently reproduce that specific call site live within the time I had. Marking an entry worked (confirmed via the checkmark in the UI itself), but the raw output capture never showed the expected printed line on quit despite a few timing adjustments on my end. The fix should still be correct by inspection, just flagging that I'm not claiming it as independently reproduced the way theQpath is.