CERBERUS/kitty
1
0
Fork 0
mirror of https://github.com/kovidgoyal/kitty.git synced 2026-05-13 08:26:56 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Sanitize ssh kitten shm open error message when sending over tty

Browse source 
This prevents sending attacker controlled data over the tty where it
might end up getting evaled by the shell if the user is doing something
like cat of unsanitized data into the terminal (something that should
never be done).
This commit is contained in:
Kovid Goyal 2026-04-24 17:25:00 +05:30
parent 4a5ab0a05e
commit e414483264
No known key found for this signature in database
GPG key ID: 06BC317B515ACE7C
1 changed files with 3 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
kittens/ssh/utils.py
View file

@ -155,7 +155,9 @@ def get_ssh_data(msgb: memoryview, request_id: str) -> Iterator[bytes|memoryview
raise ValueError(f'Incorrect request id: {rq_id!r} expecting the KITTY_PID-KITTY_WINDOW_ID for the current kitty window') raise ValueError(f'Incorrect request id: {rq_id!r} expecting the KITTY_PID-KITTY_WINDOW_ID for the current kitty window')
except Exception as e: except Exception as e:
traceback.print_exc() traceback.print_exc()
yield f'{e}\n'.encode() import re
msg = re.sub(r'[^a-zA-Z0-9 ]+', '_', str(e))
yield f'{msg}\n'.encode()
else: else:
yield b'OK\n' yield b'OK\n'
encoded_data = memoryview(env_data['tarfile'].encode('ascii')) encoded_data = memoryview(env_data['tarfile'].encode('ascii'))