Graphics protocol: Fix file descriptor leak that can be triggered by malicious clients

Also make failure responses generic to avoid leaking any filesystem
information to failed opens

docs/changelog.rst

@@ -302,6 +302,10 @@ Detailed list of changes
   object at an offset (the ``O`` key) failing unless the offset happened to be
   a multiple of the system page size
 
+- Graphics protocol: Fix file descriptor leak that can be triggered by malicious clients
+
+- Graphics protocol: Make fileopen failure responses generic to avoid leaking any information about failed files
+
 - Clipboard protocol: Report an ``EFBIG`` error to programs that try to write
   more data to the clipboard than allowed by :opt:`clipboard_max_size`, instead
   of silently truncating their data. Also fix :opt:`clipboard_max_size` being

docs/graphics-protocol.rst

@@ -360,6 +360,18 @@ from potentially untrusted sources, terminal emulators **must** refuse to read
 any device/socket/etc. special files. Only regular files are allowed.
 Additionally, terminal emulators may refuse to read files in *sensitive*
 parts of the filesystem, such as :file:`/proc`, :file:`/sys`, :file:`/dev`, etc.
+These checks should be made on the path *before* the file is opened, since
+merely opening a file can have side-effects.
+
+Because the escape codes can be emitted by a program running on a remote
+machine over SSH or by a sandboxed process, the terminal emulator **must not**
+allow such a program to use the responses to these commands to learn anything
+about files it cannot read itself. In particular, all failures to read an
+image file, be it because the file does not exist, is not readable, is not a
+regular file, lies in a sensitive location or is smaller than the client
+claimed, must be reported with a single, identical, error response. kitty
+answers with ``EBADF:Failed to read image file`` for all of these and writes
+the actual reason to its log, which only the local user can see.
 
 Local client
 ^^^^^^^^^^^^^^