Re: ? Unsafe terminal escape sequences and ANSI codes from decryption

[Please do not mail me a copy of your followup]

"G.K." <[email protected]> spake the secret code
<[email protected]> thusly:

>Is there potential for malicious escape sequences in the plaintext? 

For a hardware terminal it is doubtful.  The most they could do is
request the contents of the screen be sent to the host or auxiliary
port and not every terminal supports sending screen contents back to
the host.

For a terminal *emulator* it's always possible that they could
identify a vulnerability in the ESC processing code that could lead to
a buffer overflow and the ability to inject bytes into the stack or
heap.

>Where would I find timely information on such escape sequences and 
>mitigating any problems they could cause or safely filtering them?

Software vulnerabilities in the emulator would have to be found by
analyzing the source code (or binary code) of the emulator.  It's not
intrinsic to the ESC sequences themselves.

>What tools are there to filter out such sequences to ensure safely 
>catting in a terminal? Are there any relevant tools in the GNU coreutils?

None AFAIK.
-- 
"The Direct3D Graphics Pipeline" free book <http://tinyurl.com/d3d-pipeline>
            The Terminals Wiki <http://terminals-wiki.org>
     The Computer Graphics Museum <http://computergraphicsmuseum.org>
  Legalize Adulthood! (my blog) <http://legalizeadulthood.wordpress.com>