[PATCH] sideband: allow ANSI SGR with colon-separated subfields

[PATCH] sideband: allow ANSI SGR with colon-separated subfields

[grawity]

From: Mantas Mikulėnas <grawity@gmail.com>

The SGR values used for 256-color formatting are officially defined to
be a single field with :-separated subfields (e.g. "\e[1;38:5:XX;40m")
despite the more common but kludgy use of separate values (which then
become context-dependent and lead to misinterpretation by incompatible
terminals).

See also: https://github.com/ThomasDickey/xterm-snapshots/blob/6380a3eaed857c182ea6cfa78cd706966b2628d0/charproc.c#L2047-L2118

Signed-off-by: Mantas Mikulėnas <grawity@gmail.com>
---
 sideband.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/sideband.c b/sideband.c
index 04282a568e..6cf70ef6f6 100644
--- a/sideband.c
+++ b/sideband.c
@@ -163,6 +163,10 @@ static int handle_ansi_sequence(struct strbuf *dest, const char *src, int n)
 	 *
 	 * ESC [ [<n> [; <n>]*] m
 	 *
+	 * where <n> can be either zero-length, or a decimal number, or a
+	 * series of decimal numbers separated by a colon (for 256-color or
+	 * true-color codes).
+	 *
 	 * These are part of the Select Graphic Rendition sequences which
 	 * contain more than just color sequences, for more details see
 	 * https://en.wikipedia.org/wiki/ANSI_escape_code#SGR.
@@ -210,7 +214,7 @@ static int handle_ansi_sequence(struct strbuf *dest, const char *src, int n)
 			strbuf_add(dest, src, i + 1);
 			return i;
 		}
-		if (!isdigit(src[i]) && src[i] != ';')
+		if (!isdigit(src[i]) && src[i] != ':' && src[i] != ';')
 			break;
 	}
 
-- 
2.54.0

Re: [PATCH] sideband: allow ANSI SGR with colon-separated subfields

[Johannes Schindelin]

[-- Attachment #1: Type: text/plain, Size: 1837 bytes --]

Hi Mantas,

On Wed, 13 May 2026, grawity@nullroute.lt wrote:

> From: Mantas Mikulėnas <grawity@gmail.com>
> 
> The SGR values used for 256-color formatting are officially defined to
> be a single field with :-separated subfields (e.g. "\e[1;38:5:XX;40m")
> despite the more common but kludgy use of separate values (which then
> become context-dependent and lead to misinterpretation by incompatible
> terminals).
> 
> See also: https://github.com/ThomasDickey/xterm-snapshots/blob/6380a3eaed857c182ea6cfa78cd706966b2628d0/charproc.c#L2047-L2118

This change seems well-motivated and well-executed to me. Just in case
anybody was waiting for my objections, there ain't any coming ;-)

Ciao,
Johannes

> 
> Signed-off-by: Mantas Mikulėnas <grawity@gmail.com>
> ---
>  sideband.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/sideband.c b/sideband.c
> index 04282a568e..6cf70ef6f6 100644
> --- a/sideband.c
> +++ b/sideband.c
> @@ -163,6 +163,10 @@ static int handle_ansi_sequence(struct strbuf *dest, const char *src, int n)
>  	 *
>  	 * ESC [ [<n> [; <n>]*] m
>  	 *
> +	 * where <n> can be either zero-length, or a decimal number, or a
> +	 * series of decimal numbers separated by a colon (for 256-color or
> +	 * true-color codes).
> +	 *
>  	 * These are part of the Select Graphic Rendition sequences which
>  	 * contain more than just color sequences, for more details see
>  	 * https://en.wikipedia.org/wiki/ANSI_escape_code#SGR.
> @@ -210,7 +214,7 @@ static int handle_ansi_sequence(struct strbuf *dest, const char *src, int n)
>  			strbuf_add(dest, src, i + 1);
>  			return i;
>  		}
> -		if (!isdigit(src[i]) && src[i] != ';')
> +		if (!isdigit(src[i]) && src[i] != ':' && src[i] != ';')
>  			break;
>  	}
>  
> -- 
> 2.54.0
> 
> 

Re: [PATCH] sideband: allow ANSI SGR with colon-separated subfields

[Junio C Hamano]

Johannes Schindelin <Johannes.Schindelin@gmx.de> writes:

> Hi Mantas,
>
> On Wed, 13 May 2026, grawity@nullroute.lt wrote:
>
>> From: Mantas Mikulėnas <grawity@gmail.com>
>> 
>> The SGR values used for 256-color formatting are officially defined to
>> be a single field with :-separated subfields (e.g. "\e[1;38:5:XX;40m")
>> despite the more common but kludgy use of separate values (which then
>> become context-dependent and lead to misinterpretation by incompatible
>> terminals).
>> 
>> See also: https://github.com/ThomasDickey/xterm-snapshots/blob/6380a3eaed857c182ea6cfa78cd706966b2628d0/charproc.c#L2047-L2118
>
> This change seems well-motivated and well-executed to me. Just in case
> anybody was waiting for my objections, there ain't any coming ;-)

Should I take it as an Ack?

FWIW, this patch literally flew below my radar coverage.  Thanks for
noticing.

A need for fix-up like this does makes me doubt out decision to go
with whitelisting very narrow cases that are known to be OK (and
finding that the cases were too narrow and we need to extend),
instead of rejecting known-bad cases, by the way.

Thanks.

> Ciao,
> Johannes
>
>> 
>> Signed-off-by: Mantas Mikulėnas <grawity@gmail.com>
>> ---
>>  sideband.c | 6 +++++-
>>  1 file changed, 5 insertions(+), 1 deletion(-)
>> 
>> diff --git a/sideband.c b/sideband.c
>> index 04282a568e..6cf70ef6f6 100644
>> --- a/sideband.c
>> +++ b/sideband.c
>> @@ -163,6 +163,10 @@ static int handle_ansi_sequence(struct strbuf *dest, const char *src, int n)
>>  	 *
>>  	 * ESC [ [<n> [; <n>]*] m
>>  	 *
>> +	 * where <n> can be either zero-length, or a decimal number, or a
>> +	 * series of decimal numbers separated by a colon (for 256-color or
>> +	 * true-color codes).
>> +	 *
>>  	 * These are part of the Select Graphic Rendition sequences which
>>  	 * contain more than just color sequences, for more details see
>>  	 * https://en.wikipedia.org/wiki/ANSI_escape_code#SGR.
>> @@ -210,7 +214,7 @@ static int handle_ansi_sequence(struct strbuf *dest, const char *src, int n)
>>  			strbuf_add(dest, src, i + 1);
>>  			return i;
>>  		}
>> -		if (!isdigit(src[i]) && src[i] != ';')
>> +		if (!isdigit(src[i]) && src[i] != ':' && src[i] != ';')
>>  			break;
>>  	}
>>  
>> -- 
>> 2.54.0
>> 
>> 

Re: [PATCH] sideband: allow ANSI SGR with colon-separated subfields

[Mantas]

On 2026-07-07 21:19, Junio C Hamano wrote:
> A need for fix-up like this does makes me doubt out decision to go
> with whitelisting very narrow cases that are known to be OK (and
> finding that the cases were too narrow and we need to extend),
> instead of rejecting known-bad cases, by the way.

For the SGR sequence (CSI ... m) AFAIK there are no other value types 
besides what this patch adds (i.e. colon-separated decimal 
subparameters), so the filter will now include all possible cases. It 
already isn't picky about individual values.

As for everything else (that is escape sequences in general), I'd say 
there are way too many "bad" cases – which can toggle terminal modes, 
display images, send notifications, copy to clipboard, move windows 
around... which a remote "status text" output has no reason to include – 
and basically zero "good" cases. Though the code already disallows the 
majority of harmful cases by only accepting those starting with CSI 
("ESC [").

In fact I might personally go further and disallow even all of the 
cursor movement sequences and leave only SGR and EL (clear line). I can 
imagine a use-case for free cursor movement (parallel progress bars like 
in Arch's pacman?) but it practically requires the sender to know 
terminal dimensions to be useful, so IMO is entirely out of scope for 
sideband status output.

(Progress bar for example (OSC 9;4;n ST) might be useful, but IMO it 
should be generated client-side, with the server instead having some way 
to report an integer percentage through the protocol. In theory the 
"hyperlink" sequence (OSC 8 ; ... ST) could also be useful to send as 
part of status text, but I'd personally disallow that as well, given all 
the reporting last time someone discovered it was possible to link to a 
file:// URL.)


> Thanks.
>
>> Ciao,
>> Johannes
>>
>>> Signed-off-by: Mantas Mikulėnas <grawity@gmail.com>
>>> ---
>>>   sideband.c | 6 +++++-
>>>   1 file changed, 5 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/sideband.c b/sideband.c
>>> index 04282a568e..6cf70ef6f6 100644
>>> --- a/sideband.c
>>> +++ b/sideband.c
>>> @@ -163,6 +163,10 @@ static int handle_ansi_sequence(struct strbuf *dest, const char *src, int n)
>>>   	 *
>>>   	 * ESC [ [<n> [; <n>]*] m
>>>   	 *
>>> +	 * where <n> can be either zero-length, or a decimal number, or a
>>> +	 * series of decimal numbers separated by a colon (for 256-color or
>>> +	 * true-color codes).
>>> +	 *
>>>   	 * These are part of the Select Graphic Rendition sequences which
>>>   	 * contain more than just color sequences, for more details see
>>>   	 * https://en.wikipedia.org/wiki/ANSI_escape_code#SGR.
>>> @@ -210,7 +214,7 @@ static int handle_ansi_sequence(struct strbuf *dest, const char *src, int n)
>>>   			strbuf_add(dest, src, i + 1);
>>>   			return i;
>>>   		}
>>> -		if (!isdigit(src[i]) && src[i] != ';')
>>> +		if (!isdigit(src[i]) && src[i] != ':' && src[i] != ';')
>>>   			break;
>>>   	}
>>>   
>>> -- 
>>> 2.54.0
>>>
>>>