fix: sanitize server text in pull request messages, auth status and notification watch

Signed-off-by: bircni <bircni@icloud.com>

internal/app/auth.go

@@ -578,7 +578,7 @@ func statusLine(row authStatusRow, d terminal.Display) string {
 	if row.environment() {
 		line = "Using GITEA_TOKEN from the environment"
 		if row.User != "" {
-			line += " as " + terminal.Emphasis(row.User, d.Color)
+			line += " as " + terminal.Emphasis(terminal.SafeLine(row.User), d.Color)
 		}
 	} else {
 		line = "Logged in as " + terminal.Emphasis(terminal.SafeLine(row.User), d.Color) + " " + muted("("+credentialLabel(row.account)+")")
@@ -597,7 +597,7 @@ func statusLine(row authStatusRow, d terminal.Display) string {
 	if row.Verified != nil && *row.Verified {
 		note := "verified"
 		if len(row.Scopes) > 0 {
-			note += ", scopes: " + strings.Join(row.Scopes, ", ")
+			note += ", scopes: " + terminal.SafeLine(strings.Join(row.Scopes, ", "))
 		}
 		notes = append(notes, note)
 	}

internal/app/human_output.go

@@ -167,7 +167,7 @@ func (a *application) created(cmd *cobra.Command, item any, url string) error {
 
 // refLabel names an issue or pull request in feedback: "alice/x#5 (Fix login)".
 func refLabel(repo string, number int64, title string) string {
-	return fmt.Sprintf("%s#%d (%s)", repo, number, title)
+	return fmt.Sprintf("%s#%d (%s)", repo, number, terminal.SafeLine(title))
 }
 
 // abortBatch stops a batch instead of recording an item failure.

internal/app/human_output_test.go

@@ -406,3 +406,7 @@ func TestShowing(t *testing.T) {
 		require.Equal(t, tc.want, showing(tc.shown, tc.page, "open issues"), "%+v", tc.page)
 	}
 }
+
+func TestRefLabelDropsTerminalControls(t *testing.T) {
+	require.Equal(t, "alice/x#5 (fix ]0;pwnevil)", refLabel("alice/x", 5, "fix \x1b]0;pwn\x07evil"))
+}

internal/app/notifications.go

@@ -400,9 +400,9 @@ func watchLine(item services.Notification, d terminal.Display) string {
 		when = d.Now
 	}
 	subject := subjectRef(item)
-	details := strings.ToLower(item.Type)
+	details := terminal.SafeLine(strings.ToLower(item.Type))
 	if item.State != "" {
-		details += " · " + terminal.Colorize(stateColors[item.State], item.State, d.Color)
+		details += " · " + terminal.Colorize(stateColors[item.State], terminal.SafeLine(item.State), d.Color)
 	}
 	return terminal.Colorize("muted", when.Local().Format("15:04"), d.Color) + "  " + terminal.Emphasis(terminal.SafeLine(subject), d.Color) + "  " + terminal.SafeLine(item.Title) + "  " + details
 }