bat icon indicating copy to clipboard operation
bat copied to clipboard

Implement safety for ANSI escape sequences

Open awvalenti opened this issue 1 year ago • 1 comments
trafficstars

Basically, cat is an unsafe way to display text. cat -v is safer.

According to README, I believe bat doesn't implement this security feature. Unlike cat, bat is only used for human-readable output. For that reason, this may be a good feature. Possibly it could simply replace stuff like <Esc>x with ^[x.

Details: https://unix.stackexchange.com/questions/780938/is-it-still-unsafe-to-cat-an-arbitrary-file

awvalenti avatar Jul 30 '24 20:07 awvalenti

Just a small tip: although this isn't supported right now, bat -A/--show-all can be used to achieve something similar.

The -A option will replace invisible characters with symbols like and , and Unicode characters will be represented in escape sequence notation (e.g. \u{2500}) instead of being printed directly.

eth-p avatar Jul 31 '24 03:07 eth-p

root@main:~  :) # cat -v /tmp/test
^[[0m
Le^[[0m
LEA1^[[0m
root@main:~  :) # bat --plain /tmp/test

Le
LEA1
root@main:~  :) # bat --plain --show-all /tmp/test
␛[0m␊
Le␛[0m␊
LEA1␛[0m␊
root@main:~  :) # bat -v /tmp/test
error: unexpected argument '-v' found

  tip: to pass '-v' as a value, use '-- -v'

Usage: bat [OPTIONS] [FILE]...
       bat <COMMAND>

For more information, try '--help'.
root@main:~   2 # bat --plain --show-all --nonprintable-notation caret /tmp/test
^[[0m^J
Le^[[0m^J
LEA1^[[0m^J

unfortunately my usecase is not quite covered by this - I only want to see potentially hazardous character codes, but not linebreas

xeruf avatar Oct 10 '25 08:10 xeruf