From a6f13a64dcee0795d786a4fe139f1514174a5469 Mon Sep 17 00:00:00 2001 From: Kovid Goyal Date: Mon, 6 Nov 2023 21:28:25 +0530 Subject: [PATCH] Allow only printable ascii in echo --- kitty/window.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kitty/window.py b/kitty/window.py index c562a9de4..b6ded8026 100644 --- a/kitty/window.py +++ b/kitty/window.py @@ -1194,7 +1194,9 @@ def handle_remote_cmd(self, cmd: str) -> None: def handle_remote_echo(self, msg: str) -> None: from base64 import standard_b64decode data = standard_b64decode(msg) - data = re.sub(rb'[^a-zA-Z0-9]', b'', data) + # ensure we are not writing any control char back as this can lead to command injection on shell prompts + # Any bytes outside the printable ASCII range are removed. + data = re.sub(rb'[^ -~]', b'', data) self.write_to_child(data) def handle_remote_ssh(self, msg: str) -> None: