sideband: do allow ANSI color sequences by default
The preceding two commits introduced special handling of the sideband channel to neutralize ANSI escape sequences before sending the payload to the terminal, and `sideband.allowControlCharacters` to override that behavior. However, as reported by brian m. carlson, some `pre-receive` hooks that are actively used in practice want to color their messages and therefore rely on the fact that Git passes them through to the terminal, even though they have no way to determine whether the receiving side can actually handle Escape sequences (think e.g. about the practice recommended by Git that third-party applications wishing to use Git functionality parse the output of Git commands). In contrast to other ANSI escape sequences, it is highly unlikely that coloring sequences can be essential tools in attack vectors that mislead Git users e.g. by hiding crucial information. Therefore we can have both: Continue to allow ANSI coloring sequences to be passed to the terminal by default, and neutralize all other ANSI Escape sequences. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Johannes Schindelin committed
Mar 5, 2026 at 15:34 UTC
12f0fda905b4af3a15c125f96808e49ddbe39742
3 files changed
+91
-9
Documentation/config/sideband.adoc
+15
-3
@@ -1,5 +1,17 @@
1
sideband.allowControlCharacters::
2
By default, control characters that are delivered via the sideband
3
- are masked, to prevent potentially unwanted ANSI escape sequences
4
- from being sent to the terminal. Use this config setting to override
5
- this behavior.
3
+ are masked, except ANSI color sequences. This prevents potentially
4
+ unwanted ANSI escape sequences from being sent to the terminal. Use
5
+ this config setting to override this behavior:
6
++
7
+--
8
+ `default`::
9
+ `color`::
10
+ Allow ANSI color sequences, line feeds and horizontal tabs,
11
+ but mask all other control characters. This is the default.
12
+ `false`::
13
+ Mask all control characters other than line feeds and
14
+ horizontal tabs.
15
+ `true`::
16
+ Allow all control characters to be sent to the terminal.
17
+--
sideband.c
+62
-4
@@ -26,7 +26,12 @@ static struct keyword_entry keywords[] = {
26
{ "error", GIT_COLOR_BOLD_RED },
27
};
28
29
-static int allow_control_characters;
29
+static enum {
30
+ ALLOW_NO_CONTROL_CHARACTERS = 0,
31
+ ALLOW_ANSI_COLOR_SEQUENCES = 1<<0,
32
+ ALLOW_DEFAULT_ANSI_SEQUENCES = ALLOW_ANSI_COLOR_SEQUENCES,
33
+ ALLOW_ALL_CONTROL_CHARACTERS = 1<<1,
34
+} allow_control_characters = ALLOW_ANSI_COLOR_SEQUENCES;
35
36
/* Returns a color setting (GIT_COLOR_NEVER, etc). */
37
static enum git_colorbool use_sideband_colors(void)
@@ -41,8 +46,26 @@ static enum git_colorbool use_sideband_colors(void)
46
if (use_sideband_colors_cached != GIT_COLOR_UNKNOWN)
47
return use_sideband_colors_cached;
48
44
- repo_config_get_bool(the_repository, "sideband.allowcontrolcharacters",
45
- &allow_control_characters);
49
+ switch (repo_config_get_maybe_bool(the_repository, "sideband.allowcontrolcharacters", &i)) {
50
+ case 0: /* Boolean value */
51
+ allow_control_characters = i ? ALLOW_ALL_CONTROL_CHARACTERS :
52
+ ALLOW_NO_CONTROL_CHARACTERS;
53
+ break;
54
+ case -1: /* non-Boolean value */
55
+ if (repo_config_get_string_tmp(the_repository, "sideband.allowcontrolcharacters",
56
+ &value))
57
+ ; /* huh? `get_maybe_bool()` returned -1 */
58
+ else if (!strcmp(value, "default"))
59
+ allow_control_characters = ALLOW_DEFAULT_ANSI_SEQUENCES;
60
+ else if (!strcmp(value, "color"))
61
+ allow_control_characters = ALLOW_ANSI_COLOR_SEQUENCES;
62
+ else
63
+ warning(_("unrecognized value for `sideband."
64
+ "allowControlCharacters`: '%s'"), value);
65
+ break;
66
+ default:
67
+ break; /* not configured */
68
+ }
69
70
if (!repo_config_get_string_tmp(the_repository, key, &value))
71
use_sideband_colors_cached = git_config_colorbool(key, value);
@@ -71,9 +94,41 @@ void list_config_color_sideband_slots(struct string_list *list, const char *pref
94
list_config_item(list, prefix, keywords[i].keyword);
95
}
96
97
+static int handle_ansi_color_sequence(struct strbuf *dest, const char *src, int n)
98
+{
99
+ int i;
100
+
101
+ /*
102
+ * Valid ANSI color sequences are of the form
103
+ *
104
+ * ESC [ [<n> [; <n>]*] m
105
+ *
106
+ * These are part of the Select Graphic Rendition sequences which
107
+ * contain more than just color sequences, for more details see
108
+ * https://en.wikipedia.org/wiki/ANSI_escape_code#SGR.
109
+ */
110
+
111
+ if (allow_control_characters != ALLOW_ANSI_COLOR_SEQUENCES ||
112
+ n < 3 || src[0] != '\x1b' || src[1] != '[')
113
+ return 0;
114
+
115
+ for (i = 2; i < n; i++) {
116
+ if (src[i] == 'm') {
117
+ strbuf_add(dest, src, i + 1);
118
+ return i;
119
+ }
120
+ if (!isdigit(src[i]) && src[i] != ';')
121
+ break;
122
+ }
123
+
124
+ return 0;
125
+}
126
+
127
static void strbuf_add_sanitized(struct strbuf *dest, const char *src, int n)
128
{
76
- if (allow_control_characters) {
129
+ int i;
130
+
131
+ if (allow_control_characters == ALLOW_ALL_CONTROL_CHARACTERS) {
132
strbuf_add(dest, src, n);
133
return;
134
}
@@ -82,6 +137,9 @@ static void strbuf_add_sanitized(struct strbuf *dest, const char *src, int n)
137
for (; n && *src; src++, n--) {
138
if (!iscntrl(*src) || *src == '\t' || *src == '\n') {
139
strbuf_addch(dest, *src);
140
+ } else if ((i = handle_ansi_color_sequence(dest, src, n))) {
141
+ src += i;
142
+ n -= i;
143
} else {
144
strbuf_addch(dest, '^');
145
strbuf_addch(dest, *src == 0x7f ? '?' : 0x40 + *src);
t/t5409-colorize-remote-messages.sh
+14
-2
@@ -100,7 +100,7 @@ test_expect_success 'fallback to color.ui' '
100
101
test_expect_success 'disallow (color) control sequences in sideband' '
102
write_script .git/color-me-surprised <<-\EOF &&
103
- printf "error: Have you \\033[31mread\\033[m this?\\n" >&2
103
+ printf "error: Have you \\033[31mread\\033[m this?\\a\\n" >&2
104
exec "$@"
105
EOF
106
test_config_global uploadPack.packObjectsHook ./color-me-surprised &&
@@ -108,12 +108,24 @@ test_expect_success 'disallow (color) control sequences in sideband' '
108
109
git clone --no-local . throw-away 2>stderr &&
110
test_decode_color <stderr >decoded &&
111
+ test_grep RED decoded &&
112
+ test_grep "\\^G" stderr &&
113
+ tr -dc "\\007" <stderr >actual &&
114
+ test_must_be_empty actual &&
115
+
116
+ rm -rf throw-away &&
117
+ git -c sideband.allowControlCharacters=false \
118
+ clone --no-local . throw-away 2>stderr &&
119
+ test_decode_color <stderr >decoded &&
120
test_grep ! RED decoded &&
121
+ test_grep "\\^G" stderr &&
122
123
rm -rf throw-away &&
124
git -c sideband.allowControlCharacters clone --no-local . throw-away 2>stderr &&
125
test_decode_color <stderr >decoded &&
116
- test_grep RED decoded
126
+ test_grep RED decoded &&
127
+ tr -dc "\\007" <stderr >actual &&
128
+ test_file_not_empty actual
129
'
130
131
test_done