xinb
/
powerlevel10k
mirror of https://github.com/romkatv/powerlevel10k.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix: strip control characters from package.json version/name 

prompt_package's own minimal JSON parser already rejects a name/
version value containing a literal newline or backslash, but a raw
control byte (e.g. an ESC-based terminal escape sequence) embedded
directly in the string passed through unfiltered and was written to
the prompt as-is.

Extends the existing check to also strip C0 control characters and
DEL from the extracted value before it's stored.
This commit is contained in:
Gogs 2026-08-07 20:36:35 +08:00
parent 9253fb1c50
commit d7a1f08f9a
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
internal/p10k.zsh
View File

@ -2250,6 +2250,11 @@ prompt_package() {
(( ! $+found[$field] )) || return (( ! $+found[$field] )) || return
[[ -n $s ]] || return [[ -n $s ]] || return
[[ $s != *($'\n'|'\')* ]] || return [[ $s != *($'\n'|'\')* ]] || return
# Strip control characters (e.g. terminal escape sequences); a
# package.json field has no character restrictions, unlike a
# git ref name, so this can't be assumed safe to display as-is.
s=${s//[$'\x00'-$'\x1f'$'\x7f']/}
[[ -n $s ]] || return
found[$field]=$s found[$field]=$s
(( $#found == 2 )) && break (( $#found == 2 )) && break
fi fi