Repository navigation
Tui esc vuln - #119
Merged
Merged
Tui esc vuln#119
Conversation
Everything the panes draw comes out of a repository somebody else wrote: a file's contents, the names around it, and the diagnostics and validation findings quoting all three. None of it was escaped on the way to the styling layer, so an ESC in a file name or a finding was read by the operator's terminal as a command rather than drawn. A new safetext package encodes a control character as its Unicode picture, replacing one rune with exactly one rune, so no line changes length and the rune columns the viewer addresses syntax runs, diagnostic marks and clicks by all still land where they should. It is applied at the seams every external string passes through: fit (tree rows, source lines, syntax runs), the file panel's title, relTo, notify, and the diagnostic and validation rows. Prose the panes lay out themselves keeps its own line feeds and tabs, since neither can command a terminal. Two paths need nothing and now say so. The source viewer's body was already covered, because bubbles/textarea drops every control rune when the buffer is set; the renderer guards it anyway, since that is the widget's paste hygiene rather than a promise to us. The spec pane is fed only serializer output, and both JSON and YAML escape a control character rather than emit it - asserted by a test instead of assumed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
Detection reads every comment group in a file, so a swagger:meta was always found wherever it sat. The block itself was then taken from the file's package doc regardless of where it had been found, and what that produced depended only on whether the file happened to have one. With a package doc, an unrelated comment was parsed as the meta block: an ordinary sentence about the package could set the specification's title and version while the authored block was dropped. With no package doc, there was nothing to parse at all, and the nil comment group reached the origin recorder for the info node - a nil dereference that aborted the whole scan. Only a caller asking for provenance got that far, which is why genspec-tui hit it and the library did not. The group carrying the annotation is now the meta block, which is what detectNodes already implied and what the classifier's own documentation already claimed. A block in the package doc comment - the documented placement, and what every fixture uses - is unaffected: that group is the one carrying the annotation. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Change type
Please select: 🆕 New feature or enhancement|🔧 Bug fix'|📃 Documentation update
Short description
Fixes
Full description
Checklist