[
https://issues.apache.org/jira/browse/CAMEL-25445?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18127036#comment-18127036
]
Claus Ibsen commented on CAMEL-25445:
-------------------------------------
Fixed on main in
https://github.com/apache/camel/commit/ff0bdf925cc6c0d0f51a07d81a739759cc4daa30
and on camel-4.22.x in
https://github.com/apache/camel/commit/96618afdd8000915433bdd64aa2ba3b3a9a27447
After each frame is drawn, the TUI cleans every cell, whichever view drew it: a
control character in a cell of its own becomes a space, and a control, BiDi or
invisible format character joined to a cell is dropped. ZWJ, ZWNJ and the
variation selectors that emoji and some scripts need stay. This covers every
tab and popup, each {{--web}} session, what MCP clients read with
{{tui_get_screen}}, and recordings. The behaviour of TamboUI itself has been
reported to the TamboUI project.
_Claude Code on behalf of Claus Ibsen_
> camel-jbang-plugin-tui - sanitize 8-bit C1 control characters in displayed
> integration text
> -------------------------------------------------------------------------------------------
>
> Key: CAMEL-25445
> URL: https://issues.apache.org/jira/browse/CAMEL-25445
> Project: Camel
> Issue Type: Improvement
> Components: camel-jbang
> Reporter: Andrea Cosentino
> Assignee: Claus Ibsen
> Priority: Minor
> Fix For: 4.22.2, 4.24.0
>
>
> Text shown from monitored integrations (traced messages, error exchanges, log
> lines, span attributes, etc.) is rendered through TamboUI buffers, which
> neutralize 7-bit C0 controls but pass 8-bit C1 controls (U+0080-U+009F)
> through unchanged; in --web mode the browser terminal (xterm.js) acts on
> them. The TUI should sanitize or visibly escape C1 (and BiDi/zero-width)
> characters before placing untrusted text into a span/buffer.
> Note: the pass-through originates in the TamboUI buffer; a sanitizer on the
> Camel side is the mitigation, and the behaviour should also be reported
> upstream to TamboUI.
> Module: dsl/camel-jbang/camel-jbang-plugin-tui.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
