From d849a6ee42dabfa84704ef74d2da70c9013803c7 Mon Sep 17 00:00:00 2001 From: Devon Kirk Date: Mon, 29 Jun 2026 15:57:08 -0400 Subject: [PATCH] query_server: strip control characters from server response whois server responses are written directly to stdout without filtering terminal control characters. A malicious or compromised whois server can inject ANSI escape sequences (OSC 52 clipboard injection, terminal title manipulation, screen clearing) into the user's terminal. Filter control characters (bytes < 0x20 except tab) and DEL (0x7F) from each response line before processing. --- whois.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/whois.c b/whois.c index 60063d7..e92df84 100644 --- a/whois.c +++ b/whois.c @@ -1005,10 +1005,17 @@ char *query_server(const char *server, const char *port, const char *query) err_sys("write"); free(temp); - while (fgets(buf, sizeof(buf), fi)) { + while (fgets(buf, sizeof(buf), fi)) { if ((p = strpbrk(buf, "\r\n"))) /* remove the trailing CR/LF */ *p = '\0'; + /* strip terminal control characters to prevent escape sequence injection */ + for (p = buf; *p; p++) + if ((unsigned char)*p < 0x20 && *p != '\t') + *p = '?'; + if ((p = strchr(buf, '\x7f'))) + *p = '\0'; + if (referral_handler) referral_handler(&referral_server, buf);