WHOIS replies are written to the terminal without filtering control
characters. A malicious server or on-path attacker can use escape
sequences to manipulate the user's terminal.
Sanitize text after character-set conversion and reject referrals with
control characters before recursion. Sanitize referral status output as
well, so the response and referral paths both preserve ISO-2022-JP
conversion without passing terminal controls through.
