fix(terminal): drop escape sequences that markdown character references decode to

Signed-off-by: bircni <bircni@icloud.com>

internal/terminal/view_test.go

@@ -113,3 +113,14 @@ func TestMarkdownEnabled(t *testing.T) {
 	require.False(t, MarkdownEnabled("raw", true))
 	require.False(t, MarkdownEnabled("auto", false))
 }
+
+func TestMarkdownDropsEscapesFromCharacterReferences(t *testing.T) {
+	for _, in := range []string{"a ]0;pwned b", "a [31m b", "a ]52;c;x b", "a ›31m b"} {
+		out := Markdown(in, Display{Width: 80})
+		for _, r := range out {
+			if r == 0x1b || r == 0x07 || (r >= 0x80 && r < 0xa0) {
+				t.Fatalf("Markdown(%q) = %q contains control %U", in, out, r)
+			}
+		}
+	}
+}