From a91b713dcec4d17f76155f0cd6b26903c59b9c19 Mon Sep 17 00:00:00 2001 From: Lukasz Kasprzak Date: Mon, 14 Sep 2026 22:31:12 +0200 Subject: plan 10: stderr messages cannot be split by quoted newlines; config paths escaped; krino new refuses control characters; independent terminal oracle --- internal/config/skel.go | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'internal/config/skel.go') diff --git a/internal/config/skel.go b/internal/config/skel.go index ca914e3..2e54894 100644 --- a/internal/config/skel.go +++ b/internal/config/skel.go @@ -10,6 +10,7 @@ import ( "io/fs" "os" "path/filepath" + "unicode" "unicode/utf8" "krino/internal/sexp" @@ -72,6 +73,13 @@ func NewDir(mainFile, name, path string) (string, error) { if !utf8.ValidString(abs) { return "", fmt.Errorf("%q is not valid UTF-8; krino's config is UTF-8 text, so rename the directory first", abs) } + // Nor control or bidirectional characters: a directory unpacked from a + // download could name itself with escape codes (re-review cli F1). + for _, r := range abs { + if unicode.IsControl(r) || unicode.Is(unicode.Bidi_Control, r) || unicode.In(r, unicode.Zl, unicode.Zp) { + return "", fmt.Errorf("%q holds control or bidirectional characters; rename the directory first", abs) + } + } if fi, err := os.Stat(abs); err != nil || !fi.IsDir() { return "", fmt.Errorf("%s is not a directory", abs) } -- cgit v1.3