Re: xterm terminal crash due to malicious character sequences in file name

[Collin Funk <collin.funk1 () gmail com>]

Hi Erik,

Erik Auerswald <auerswal () unix-ag uni-kl de> said:

> On Wed, Aug 13, 2025 at 07:00:58PM +0200, Vincent Lefevre wrote:
> > The following makes the xterm terminal crash
> >
> >   touch "$(printf "file\e[H\e[c\n\b")"
> >   gunzip file*
> >
> > due to malicious character sequences in the file name and a bug in
> > xterm. Same issue with bunzip2 instead of gunzip.
>
> I do not expect this to only happen with gunzip and bzip2.  Does this
> happen with any program that prints the filename without any escaping,
> e.g., "echo file*", and most programs that print the provided filename
> when reporting any associated problem (i.e., all that do not escape or
> suppress non-printable filename characters or bytes)?

Yep, any program will print non-printable characters unless it has some
logic to not do so.

Many GNU programs (from Coreutils and Findutils, for example) use the
'quote' module from Gnulib to print file names in a way that can be
copy-pasted in a shell shell command [1]. Here is an example using ls
from Coreutils:

    $ touch 'first
    file'
    $ touch 'second file'
    $ ls
    'first'$'\n''file'  'second file'

Generally this is an extra program feature. The real issue here was the
xterm crash.

I guess it would be nice for gzip to quote file names nicely. I'll have
a look at sending a patch. The only reason tjat it doesn't already do it
is probably because it is changed less frequently than other GNU
programs.

Collin

[1] https://www.gnu.org/software/gnulib/manual/gnulib.html#Quoting-1