fix(terminal): strip C1 control characters (0x80-0x9f) in renderTerminalBufferText#103274
Merged
steipete merged 2 commits intoJul 10, 2026
Merged
Conversation
…nalBufferText renderTerminalBufferText filters C0 control characters (0x00-0x1f) and DEL (0x7f) but did not filter C1 controls (0x80-0x9f). The C1 range includes the CSI (Control Sequence Introducer) at 0x9b, an alternative ANSI escape prefix that stripAnsiSequences() may miss. Add the C1 range to CONTROL_BYTES_REGEX to strip all C1 bytes. Same pattern as the C1 fix in sanitizeForConsole (openclaw#103226). Co-Authored-By: Claude <[email protected]>
This was referenced Jul 10, 2026
This was referenced Jul 10, 2026
Contributor
|
Land-ready maintainer pass complete.
Merging with contributor credit preserved. Thanks @lsr911. |
Contributor
|
Merged via squash.
|
This was referenced Jul 10, 2026
github-actions Bot
pushed a commit
to Desicool/openclaw
that referenced
this pull request
Jul 10, 2026
…nalBufferText (openclaw#103274) renderTerminalBufferText filters C0 control characters (0x00-0x1f) and DEL (0x7f) but did not filter C1 controls (0x80-0x9f). The C1 range includes the CSI (Control Sequence Introducer) at 0x9b, an alternative ANSI escape prefix that stripAnsiSequences() may miss. Add the C1 range to CONTROL_BYTES_REGEX to strip all C1 bytes. Same pattern as the C1 fix in sanitizeForConsole (openclaw#103226). Co-authored-by: Claude <[email protected]> Co-authored-by: Peter Steinberger <[email protected]>
This was referenced Jul 10, 2026
Merged
lsr911
added a commit
to lsr911/openclaw
that referenced
this pull request
Jul 12, 2026
…g sinks Terminal-control sanitizers guard untrusted text before it reaches a terminal or log (CWE-117). The canonical range is C0 (0x00-0x1f), DEL (0x7f), and C1 (0x80-0x9f) - the range already used by the shared sanitizeForLog and by renderTerminalBufferText (openclaw#103274). C1 includes the 8-bit CSI introducer U+009B. Deliberate sink-wide pass: closes the C1 gap in twelve terminal/log output sinks, each keeping its own strip/escape/replace/truncate/reject action and gaining a focused valid-U+009B regression test. The PR body audits every other control-char sink (already-covered, deferred, or out-of-scope). Consolidates the isolated PRs openclaw#103379 openclaw#103380 openclaw#103381 openclaw#103382 openclaw#103383 openclaw#103402 Signed-off-by: lsr911 <[email protected]> openclaw#103405 and re-lands the sanitizeForConsole fix from openclaw#103226 cleanly.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What Problem This Solves
renderTerminalBufferText()insrc/gateway/terminal/buffer-text.tsfilters C0 control characters (0x00-0x1f) and DEL (0x7f) viaCONTROL_BYTES_REGEX, but leaves the C1 control range (0x80-0x9f) unhandled.The C1 range includes 0x9b (CSI — Control Sequence Introducer), an alternative ANSI escape prefix equivalent to ESC [. While
stripAnsiSequences()is called first and handles standard ESC-based sequences, the C1 CSI (0x9b) variant may survive in terminal output.Same pattern as
sanitizeForConsole(#103226) and the comprehensivesanitizeForLoginpackages/terminal-core/src/ansi.ts.Why This Change Was Made
Add the C1 range (0x80-0x9f) to
CONTROL_BYTES_REGEXalongside the existing C0 range. No behavioral change for ASCII-only terminal output.User Impact
Terminal buffer text containing C1 control bytes no longer leaks ANSI escape sequences into agent tool output displayed via
terminal.text. No impact on normal terminal output which is predominantly ASCII.Evidence
C1 CSI stripping behavior
Same proven pattern as #103226
sanitizeForConsoleC1 fix follows identical approach. The C1 range (0x80-0x9f) covers all 32 C1 control bytes.Files Changed (1 file, +5/-2)
🤖 Generated with Claude Code