log15
log15 copied to clipboard
format: stricter quoting based on strconv
This PR replaces the escapeString
function with the more stricter quoting done by strconv
. Previously, special non-printable characters such as bash escape characters could be allowed through. Such characters can change the terminal colour, break lines, delete previously printed characters etc, and may represent a security vulnerability in the application using this library.
~~This PR does change API a bit, since previously log15 did not quote all messages, if they were deemed to not require quoting. It would be possible to revert that change, but I actually think it's better to be consistent, so I didn't add the extra checks to see if the value should be un-quoted again.~~
This PR now avoids quoting messages that are plain lower range ascii. It does now quote otherwise printable messages with characters like äö
, which was not previously quoted.