sideband: add options to allow more control sequences to be passed through
Even though control sequences that erase characters are quite juicy for attack scenarios, where attackers are eager to hide traces of suspicious activities, during the review of the side band sanitizing patch series concerns were raised that there might be some legimitate scenarios where Git server's `pre-receive` hooks use those sequences in a benign way. Control sequences to move the cursor can likewise be used to hide tracks by overwriting characters, and have been equally pointed out as having legitimate users. Let's add options to let users opt into passing through those ANSI Escape sequences: `sideband.allowControlCharacters` now supports also `cursor` and `erase`, and it parses the value as a comma-separated list. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Johannes Schindelin committed
Mar 5, 2026 at 15:34 UTC
128914438a0d2d55ae34314a0881f55a797024d5
3 files changed
+123
-15
Documentation/config/sideband.adoc
+8
-1
@@ -2,13 +2,20 @@ sideband.allowControlCharacters::
2
By default, control characters that are delivered via the sideband
3
are masked, except ANSI color sequences. This prevents potentially
4
unwanted ANSI escape sequences from being sent to the terminal. Use
5
- this config setting to override this behavior:
5
+ this config setting to override this behavior (the value can be
6
+ a comma-separated list of the following keywords):
7
+
8
--
9
`default`::
10
`color`::
11
Allow ANSI color sequences, line feeds and horizontal tabs,
12
but mask all other control characters. This is the default.
13
+ `cursor:`:
14
+ Allow control sequences that move the cursor. This is
15
+ disabled by default.
16
+ `erase`::
17
+ Allow control sequences that erase charactrs. This is
18
+ disabled by default.
19
`false`::
20
Mask all control characters other than line feeds and
21
horizontal tabs.
sideband.c
+77
-14
@@ -29,9 +29,43 @@ static struct keyword_entry keywords[] = {
29
static enum {
30
ALLOW_NO_CONTROL_CHARACTERS = 0,
31
ALLOW_ANSI_COLOR_SEQUENCES = 1<<0,
32
+ ALLOW_ANSI_CURSOR_MOVEMENTS = 1<<1,
33
+ ALLOW_ANSI_ERASE = 1<<2,
34
ALLOW_DEFAULT_ANSI_SEQUENCES = ALLOW_ANSI_COLOR_SEQUENCES,
33
- ALLOW_ALL_CONTROL_CHARACTERS = 1<<1,
34
-} allow_control_characters = ALLOW_ANSI_COLOR_SEQUENCES;
35
+ ALLOW_ALL_CONTROL_CHARACTERS = 1<<3,
36
+} allow_control_characters = ALLOW_DEFAULT_ANSI_SEQUENCES;
37
+
38
+static inline int skip_prefix_in_csv(const char *value, const char *prefix,
39
+ const char **out)
40
+{
41
+ if (!skip_prefix(value, prefix, &value) ||
42
+ (*value && *value != ','))
43
+ return 0;
44
+ *out = value + !!*value;
45
+ return 1;
46
+}
47
+
48
+static void parse_allow_control_characters(const char *value)
49
+{
50
+ allow_control_characters = ALLOW_NO_CONTROL_CHARACTERS;
51
+ while (*value) {
52
+ if (skip_prefix_in_csv(value, "default", &value))
53
+ allow_control_characters |= ALLOW_DEFAULT_ANSI_SEQUENCES;
54
+ else if (skip_prefix_in_csv(value, "color", &value))
55
+ allow_control_characters |= ALLOW_ANSI_COLOR_SEQUENCES;
56
+ else if (skip_prefix_in_csv(value, "cursor", &value))
57
+ allow_control_characters |= ALLOW_ANSI_CURSOR_MOVEMENTS;
58
+ else if (skip_prefix_in_csv(value, "erase", &value))
59
+ allow_control_characters |= ALLOW_ANSI_ERASE;
60
+ else if (skip_prefix_in_csv(value, "true", &value))
61
+ allow_control_characters = ALLOW_ALL_CONTROL_CHARACTERS;
62
+ else if (skip_prefix_in_csv(value, "false", &value))
63
+ allow_control_characters = ALLOW_NO_CONTROL_CHARACTERS;
64
+ else
65
+ warning(_("unrecognized value for `sideband."
66
+ "allowControlCharacters`: '%s'"), value);
67
+ }
68
+}
69
70
/* Returns a color setting (GIT_COLOR_NEVER, etc). */
71
static enum git_colorbool use_sideband_colors(void)
@@ -55,13 +89,8 @@ static enum git_colorbool use_sideband_colors(void)
89
if (repo_config_get_string_tmp(the_repository, "sideband.allowcontrolcharacters",
90
&value))
91
; /* huh? `get_maybe_bool()` returned -1 */
58
- else if (!strcmp(value, "default"))
59
- allow_control_characters = ALLOW_DEFAULT_ANSI_SEQUENCES;
60
- else if (!strcmp(value, "color"))
61
- allow_control_characters = ALLOW_ANSI_COLOR_SEQUENCES;
92
else
63
- warning(_("unrecognized value for `sideband."
64
- "allowControlCharacters`: '%s'"), value);
93
+ parse_allow_control_characters(value);
94
break;
95
default:
96
break; /* not configured */
@@ -94,7 +123,7 @@ void list_config_color_sideband_slots(struct string_list *list, const char *pref
123
list_config_item(list, prefix, keywords[i].keyword);
124
}
125
97
-static int handle_ansi_color_sequence(struct strbuf *dest, const char *src, int n)
126
+static int handle_ansi_sequence(struct strbuf *dest, const char *src, int n)
127
{
128
int i;
129
@@ -106,14 +135,47 @@ static int handle_ansi_color_sequence(struct strbuf *dest, const char *src, int
135
* These are part of the Select Graphic Rendition sequences which
136
* contain more than just color sequences, for more details see
137
* https://en.wikipedia.org/wiki/ANSI_escape_code#SGR.
138
+ *
139
+ * The cursor movement sequences are:
140
+ *
141
+ * ESC [ n A - Cursor up n lines (CUU)
142
+ * ESC [ n B - Cursor down n lines (CUD)
143
+ * ESC [ n C - Cursor forward n columns (CUF)
144
+ * ESC [ n D - Cursor back n columns (CUB)
145
+ * ESC [ n E - Cursor next line, beginning (CNL)
146
+ * ESC [ n F - Cursor previous line, beginning (CPL)
147
+ * ESC [ n G - Cursor to column n (CHA)
148
+ * ESC [ n ; m H - Cursor position (row n, col m) (CUP)
149
+ * ESC [ n ; m f - Same as H (HVP)
150
+ *
151
+ * The sequences to erase characters are:
152
+ *
153
+ *
154
+ * ESC [ 0 J - Clear from cursor to end of screen (ED)
155
+ * ESC [ 1 J - Clear from cursor to beginning of screen (ED)
156
+ * ESC [ 2 J - Clear entire screen (ED)
157
+ * ESC [ 3 J - Clear entire screen + scrollback (ED) - xterm extension
158
+ * ESC [ 0 K - Clear from cursor to end of line (EL)
159
+ * ESC [ 1 K - Clear from cursor to beginning of line (EL)
160
+ * ESC [ 2 K - Clear entire line (EL)
161
+ * ESC [ n M - Delete n lines (DL)
162
+ * ESC [ n P - Delete n characters (DCH)
163
+ * ESC [ n X - Erase n characters (ECH)
164
+ *
165
+ * For a comprehensive list of common ANSI Escape sequences, see
166
+ * https://www.xfree86.org/current/ctlseqs.html
167
*/
168
111
- if (allow_control_characters != ALLOW_ANSI_COLOR_SEQUENCES ||
112
- n < 3 || src[0] != '\x1b' || src[1] != '[')
169
+ if (n < 3 || src[0] != '\x1b' || src[1] != '[')
170
return 0;
171
172
for (i = 2; i < n; i++) {
116
- if (src[i] == 'm') {
173
+ if (((allow_control_characters & ALLOW_ANSI_COLOR_SEQUENCES) &&
174
+ src[i] == 'm') ||
175
+ ((allow_control_characters & ALLOW_ANSI_CURSOR_MOVEMENTS) &&
176
+ strchr("ABCDEFGHf", src[i])) ||
177
+ ((allow_control_characters & ALLOW_ANSI_ERASE) &&
178
+ strchr("JKMPX", src[i]))) {
179
strbuf_add(dest, src, i + 1);
180
return i;
181
}
@@ -128,7 +190,7 @@ static void strbuf_add_sanitized(struct strbuf *dest, const char *src, int n)
190
{
191
int i;
192
131
- if (allow_control_characters == ALLOW_ALL_CONTROL_CHARACTERS) {
193
+ if ((allow_control_characters & ALLOW_ALL_CONTROL_CHARACTERS)) {
194
strbuf_add(dest, src, n);
195
return;
196
}
@@ -137,7 +199,8 @@ static void strbuf_add_sanitized(struct strbuf *dest, const char *src, int n)
199
for (; n && *src; src++, n--) {
200
if (!iscntrl(*src) || *src == '\t' || *src == '\n') {
201
strbuf_addch(dest, *src);
140
- } else if ((i = handle_ansi_color_sequence(dest, src, n))) {
202
+ } else if (allow_control_characters != ALLOW_NO_CONTROL_CHARACTERS &&
203
+ (i = handle_ansi_sequence(dest, src, n))) {
204
src += i;
205
n -= i;
206
} else {
t/t5409-colorize-remote-messages.sh
+38
@@ -128,4 +128,42 @@ test_expect_success 'disallow (color) control sequences in sideband' '
128
test_file_not_empty actual
129
'
130
131
+test_decode_csi() {
132
+ awk '{
133
+ while (match($0, /\033/) != 0) {
134
+ printf "%sCSI ", substr($0, 1, RSTART-1);
135
+ $0 = substr($0, RSTART + RLENGTH, length($0) - RSTART - RLENGTH + 1);
136
+ }
137
+ print
138
+ }'
139
+}
140
+
141
+test_expect_success 'control sequences in sideband allowed by default' '
142
+ write_script .git/color-me-surprised <<-\EOF &&
143
+ printf "error: \\033[31mcolor\\033[m\\033[Goverwrite\\033[Gerase\\033[K\\033?25l\\n" >&2
144
+ exec "$@"
145
+ EOF
146
+ test_config_global uploadPack.packObjectsHook ./color-me-surprised &&
147
+ test_commit need-at-least-one-commit-at-least &&
148
+
149
+ rm -rf throw-away &&
150
+ git clone --no-local . throw-away 2>stderr &&
151
+ test_decode_color <stderr >color-decoded &&
152
+ test_decode_csi <color-decoded >decoded &&
153
+ test_grep ! "CSI \\[K" decoded &&
154
+ test_grep ! "CSI \\[G" decoded &&
155
+ test_grep "\\^\\[?25l" decoded &&
156
+
157
+ rm -rf throw-away &&
158
+ git -c sideband.allowControlCharacters=erase,cursor,color \
159
+ clone --no-local . throw-away 2>stderr &&
160
+ test_decode_color <stderr >color-decoded &&
161
+ test_decode_csi <color-decoded >decoded &&
162
+ test_grep "RED" decoded &&
163
+ test_grep "CSI \\[K" decoded &&
164
+ test_grep "CSI \\[G" decoded &&
165
+ test_grep ! "\\^\\[\\[K" decoded &&
166
+ test_grep ! "\\^\\[\\[G" decoded
167
+'
168
+
169
test_done