nik/whois
1
0
Fork 0
mirror of https://github.com/rfc1036/whois.git synced 2026-08-01 07:20:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

query_server: strip control characters from server response

Browse Source 
whois server responses are written directly to stdout without filtering
terminal control characters. A malicious or compromised whois server can
inject ANSI escape sequences (OSC 52 clipboard injection, terminal title
manipulation, screen clearing) into the user's terminal.

Filter control characters (bytes < 0x20 except tab) and DEL (0x7F) from
each response line before processing.
This commit is contained in:
Devon Kirk 2026-06-29 15:57:08 -04:00
parent 1024386831
commit d849a6ee42
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
whois.c
View File

@ -1005,10 +1005,17 @@ char *query_server(const char *server, const char *port, const char *query)
err_sys("write");
free(temp);
while (fgets(buf, sizeof(buf), fi)) {
while (fgets(buf, sizeof(buf), fi)) {
if ((p = strpbrk(buf, "\r\n"))) /* remove the trailing CR/LF */
*p = '\0';
/* strip terminal control characters to prevent escape sequence injection */
for (p = buf; *p; p++)
if ((unsigned char)*p < 0x20 && *p != '\t')
*p = '?';
if ((p = strchr(buf, '\x7f')))
*p = '\0';
if (referral_handler)
referral_handler(&referral_server, buf);