Stripping out just the control characters isn’t enough. A lot of terminal control sequences start with a single control character followed by normal printable characters but such printable characters are part of the control sequence. And even when you strip out entire terminal control sequences there are still other Unicode characters that will play tricks. Examples include the Unicode right-to-left override, which is not an ASCII control character but a Unicode control character. There are also dozens of space characters that look like spaces but won’t be split by ASCII word splitting processing, etc.
replyI'm OK with turning ANSI control sequences into garbage, as long as its safe garbage. But yeah, seems like I should find a library that covers all this.
replyI don't understand the UX you have in mind, just do it like SSH used to do, a non-echo input field?
replyOh, it's not like a password (where you'd want to prevent echo). The value is actually a digest of a public key -- one instance of the program prints the digest, and the user has to enter it into the other instance of the program. This is for setting up a secure P2P connection.
replyI may have misstated the problem above. What I really need to ensure is that a malicious output can't say "the digest is abc123" and trick the user into pasting that into the other program (when the real digest is def456).
Just have a link that the user can click that copies the correct hash to the clipboard.
replyBoth ends are terminal programs.
replySo side A prints out a value, side B has to input it using the user as the go between.
replyHmm...
Isn't there a public key based way to avoid needing the user to do this.
Not that I can think of, no. This is the public key based way of doing things.
replyI mean the value gets encrypted or signed with a private key.
reply