Re: [PATCH] sideband: allow ANSI SGR with colon-separated subfields

[Mantas <grawity@nullroute.lt>]

On 2026-07-07 21:19, Junio C Hamano wrote:
> A need for fix-up like this does makes me doubt out decision to go
> with whitelisting very narrow cases that are known to be OK (and
> finding that the cases were too narrow and we need to extend),
> instead of rejecting known-bad cases, by the way.

For the SGR sequence (CSI ... m) AFAIK there are no other value types 
besides what this patch adds (i.e. colon-separated decimal 
subparameters), so the filter will now include all possible cases. It 
already isn't picky about individual values.

As for everything else (that is escape sequences in general), I'd say 
there are way too many "bad" cases – which can toggle terminal modes, 
display images, send notifications, copy to clipboard, move windows 
around... which a remote "status text" output has no reason to include – 
and basically zero "good" cases. Though the code already disallows the 
majority of harmful cases by only accepting those starting with CSI 
("ESC [").

In fact I might personally go further and disallow even all of the 
cursor movement sequences and leave only SGR and EL (clear line). I can 
imagine a use-case for free cursor movement (parallel progress bars like 
in Arch's pacman?) but it practically requires the sender to know 
terminal dimensions to be useful, so IMO is entirely out of scope for 
sideband status output.

(Progress bar for example (OSC 9;4;n ST) might be useful, but IMO it 
should be generated client-side, with the server instead having some way 
to report an integer percentage through the protocol. In theory the 
"hyperlink" sequence (OSC 8 ; ... ST) could also be useful to send as 
part of status text, but I'd personally disallow that as well, given all 
the reporting last time someone discovered it was possible to link to a 
file:// URL.)


> Thanks.
>
>> Ciao,
>> Johannes
>>
>>> Signed-off-by: Mantas Mikulėnas <grawity@gmail.com>
>>> ---
>>>   sideband.c | 6 +++++-
>>>   1 file changed, 5 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/sideband.c b/sideband.c
>>> index 04282a568e..6cf70ef6f6 100644
>>> --- a/sideband.c
>>> +++ b/sideband.c
>>> @@ -163,6 +163,10 @@ static int handle_ansi_sequence(struct strbuf *dest, const char *src, int n)
>>>   	 *
>>>   	 * ESC [ [<n> [; <n>]*] m
>>>   	 *
>>> +	 * where <n> can be either zero-length, or a decimal number, or a
>>> +	 * series of decimal numbers separated by a colon (for 256-color or
>>> +	 * true-color codes).
>>> +	 *
>>>   	 * These are part of the Select Graphic Rendition sequences which
>>>   	 * contain more than just color sequences, for more details see
>>>   	 * https://en.wikipedia.org/wiki/ANSI_escape_code#SGR.
>>> @@ -210,7 +214,7 @@ static int handle_ansi_sequence(struct strbuf *dest, const char *src, int n)
>>>   			strbuf_add(dest, src, i + 1);
>>>   			return i;
>>>   		}
>>> -		if (!isdigit(src[i]) && src[i] != ';')
>>> +		if (!isdigit(src[i]) && src[i] != ':' && src[i] != ';')
>>>   			break;
>>>   	}
>>>   
>>> -- 
>>> 2.54.0
>>>
>>>