From 3d10badb8b5a25dcceb6c89b6f3d4e273e832026 Mon Sep 17 00:00:00 2001 From: bircni Date: Sun, 18 Oct 2026 17:19:10 +0200 Subject: [PATCH] fix: sanitize server text in pull request messages, auth status and notification watch Signed-off-by: bircni --- internal/app/auth.go | 4 ++-- internal/app/human_output.go | 2 +- internal/app/human_output_test.go | 4 ++++ internal/app/notifications.go | 4 ++-- 4 files changed, 9 insertions(+), 5 deletions(-) diff --git a/internal/app/auth.go b/internal/app/auth.go index 2dc8ad73..b53dc474 100644 --- a/internal/app/auth.go +++ b/internal/app/auth.go @@ -578,7 +578,7 @@ func statusLine(row authStatusRow, d terminal.Display) string { if row.environment() { line = "Using GITEA_TOKEN from the environment" if row.User != "" { - line += " as " + terminal.Emphasis(row.User, d.Color) + line += " as " + terminal.Emphasis(terminal.SafeLine(row.User), d.Color) } } else { line = "Logged in as " + terminal.Emphasis(terminal.SafeLine(row.User), d.Color) + " " + muted("("+credentialLabel(row.account)+")") @@ -597,7 +597,7 @@ func statusLine(row authStatusRow, d terminal.Display) string { if row.Verified != nil && *row.Verified { note := "verified" if len(row.Scopes) > 0 { - note += ", scopes: " + strings.Join(row.Scopes, ", ") + note += ", scopes: " + terminal.SafeLine(strings.Join(row.Scopes, ", ")) } notes = append(notes, note) } diff --git a/internal/app/human_output.go b/internal/app/human_output.go index 27fa788e..c5333fe5 100644 --- a/internal/app/human_output.go +++ b/internal/app/human_output.go @@ -167,7 +167,7 @@ func (a *application) created(cmd *cobra.Command, item any, url string) error { // refLabel names an issue or pull request in feedback: "alice/x#5 (Fix login)". func refLabel(repo string, number int64, title string) string { - return fmt.Sprintf("%s#%d (%s)", repo, number, title) + return fmt.Sprintf("%s#%d (%s)", repo, number, terminal.SafeLine(title)) } // abortBatch stops a batch instead of recording an item failure. diff --git a/internal/app/human_output_test.go b/internal/app/human_output_test.go index 94eaa5d0..5c13489b 100644 --- a/internal/app/human_output_test.go +++ b/internal/app/human_output_test.go @@ -406,3 +406,7 @@ func TestShowing(t *testing.T) { require.Equal(t, tc.want, showing(tc.shown, tc.page, "open issues"), "%+v", tc.page) } } + +func TestRefLabelDropsTerminalControls(t *testing.T) { + require.Equal(t, "alice/x#5 (fix ]0;pwnevil)", refLabel("alice/x", 5, "fix \x1b]0;pwn\x07evil")) +} diff --git a/internal/app/notifications.go b/internal/app/notifications.go index 19178791..4b819732 100644 --- a/internal/app/notifications.go +++ b/internal/app/notifications.go @@ -400,9 +400,9 @@ func watchLine(item services.Notification, d terminal.Display) string { when = d.Now } subject := subjectRef(item) - details := strings.ToLower(item.Type) + details := terminal.SafeLine(strings.ToLower(item.Type)) if item.State != "" { - details += " · " + terminal.Colorize(stateColors[item.State], item.State, d.Color) + details += " · " + terminal.Colorize(stateColors[item.State], terminal.SafeLine(item.State), d.Color) } return terminal.Colorize("muted", when.Local().Format("15:04"), d.Color) + " " + terminal.Emphasis(terminal.SafeLine(subject), d.Color) + " " + terminal.SafeLine(item.Title) + " " + details }