log15 icon indicating copy to clipboard operation
log15 copied to clipboard

format: stricter quoting based on strconv

Open holiman opened this issue 4 years ago • 0 comments

This PR replaces the escapeString function with the more stricter quoting done by strconv. Previously, special non-printable characters such as bash escape characters could be allowed through. Such characters can change the terminal colour, break lines, delete previously printed characters etc, and may represent a security vulnerability in the application using this library.

~~This PR does change API a bit, since previously log15 did not quote all messages, if they were deemed to not require quoting. It would be possible to revert that change, but I actually think it's better to be consistent, so I didn't add the extra checks to see if the value should be un-quoted again.~~

This PR now avoids quoting messages that are plain lower range ascii. It does now quote otherwise printable messages with characters like äö, which was not previously quoted.

holiman avatar Apr 27 '20 08:04 holiman