snapshot of https://github.com/mattermost/mattermost.git (master, 2026-09-16; blobs > 131072B omitted)

server/cmd/mmctl/printer/printer_helpers_test.go

@@ -0,0 +1,136 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package printer
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestSanitizeForTerminal(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    string
+		expected string
+	}{
+		{
+			name:     "plain text unchanged",
+			input:    "Hello, World!",
+			expected: "Hello, World!",
+		},
+		{
+			name:     "preserves newlines and tabs",
+			input:    "Line 1\nLine 2\tTabbed",
+			expected: "Line 1\nLine 2\tTabbed",
+		},
+		{
+			name:     "removes ANSI color codes",
+			input:    "\x1b[31mRed Text\x1b[0m",
+			expected: "Red Text",
+		},
+		{
+			name:     "removes cursor movement sequences",
+			input:    "\x1b[2J\x1b[H\x1b[1;1HMalicious content",
+			expected: "Malicious content",
+		},
+		{
+			name:     "removes OSC clipboard hijacking (BEL terminated)",
+			input:    "Normal text\x1b]52;c;SGVsbG8gV29ybGQ=\x07more text",
+			expected: "Normal textmore text",
+		},
+		{
+			name:     "removes OSC clipboard hijacking (ST terminated)",
+			input:    "Normal text\x1b]52;c;SGVsbG8gV29ybGQ=\x1b\\more text",
+			expected: "Normal textmore text",
+		},
+		{
+			name:     "removes OSC window title manipulation",
+			input:    "\x1b]0;Fake Terminal Title\x07Real content",
+			expected: "Real content",
+		},
+		{
+			name:     "removes screen clearing sequences",
+			input:    "\x1b[2J\x1b[3JCleared screen",
+			expected: "Cleared screen",
+		},
+		{
+			name:     "removes bold/underline formatting",
+			input:    "\x1b[1mBold\x1b[0m \x1b[4mUnderline\x1b[0m",
+			expected: "Bold Underline",
+		},
+		{
+			name:     "removes multiple escape sequences",
+			input:    "\x1b[31m\x1b[1m\x1b[4mStyled\x1b[0m",
+			expected: "Styled",
+		},
+		{
+			name:     "removes control characters (NUL, BEL, etc)",
+			input:    "Hello\x00World\x07Test\x08Back",
+			expected: "HelloWorldTestBack",
+		},
+		{
+			name:     "removes DEL character",
+			input:    "Hello\x7fWorld",
+			expected: "HelloWorld",
+		},
+		{
+			name:     "handles complex attack payload",
+			input:    "\x1b[2J\x1b[H\x1b]0;HACKED\x07\x1b[31mFake error!\x1b[0m\nEnter password: ",
+			expected: "Fake error!\nEnter password: ",
+		},
+		{
+			name:     "removes DCS sequences",
+			input:    "Before\x1bPsome DCS content\x1b\\After",
+			expected: "BeforeAfter",
+		},
+		{
+			name:     "handles empty string",
+			input:    "",
+			expected: "",
+		},
+		{
+			name:     "handles unicode text with escape sequences",
+			input:    "\x1b[31m你好世界\x1b[0m emoji: 🎉",
+			expected: "你好世界 emoji: 🎉",
+		},
+		{
+			name:     "removes CSI with parameters",
+			input:    "\x1b[38;5;196mExtended color\x1b[0m",
+			expected: "Extended color",
+		},
+		{
+			name:     "removes CSI with question mark",
+			input:    "\x1b[?25lHide cursor\x1b[?25h",
+			expected: "Hide cursor",
+		},
+		{
+			name:     "preserves carriage return",
+			input:    "Line with\rcarriage return",
+			expected: "Line with\rcarriage return",
+		},
+		{
+			name:     "removes APC sequences",
+			input:    "Before\x1b_APC content\x1b\\After",
+			expected: "BeforeAfter",
+		},
+		{
+			name:     "removes nested escape attempts",
+			input:    "\x1b[31m\x1b]0;title\x07nested\x1b[0m",
+			expected: "nested",
+		},
+		{
+			name:     "handles realistic malicious message",
+			input:    "Please run: \x1b[2J\x1b[Hsudo rm -rf /\x1b]52;c;cm0gLXJmIC8=\x07",
+			expected: "Please run: sudo rm -rf /",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := SanitizeForTerminal(tt.input)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}