You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Table output doesn't neutralize terminal control characters in server data #206
nsc/output/table.py (_format_cell, _format_colored) runs cell values through Rich's markup escape(). That stops [..] markup, but control characters such as ESC (\x1b) and BEL, and bidi overrides, still reach the terminal. A NetBox object whose name or description contains a terminal escape sequence can therefore drive the user's terminal when listed in table output: retitle it, clear the screen, or spoof text.
#205 fixed the same class of problem for the TTY error panel with _printable in nsc/output/errors.py, which shows control and format characters as visible \x.. escapes. The table formatter, and any other Rich-rendered path that prints server text (e.g. the --explain panel in nsc/output/explain.py and the TUI), should get the same treatment. Moving _printable to a shared helper would cover all of them.
JSON, JSONL, YAML and CSV output already escape or quote these characters, or don't target a terminal, so they're out of scope.
Activity
thomaschristory commentedon Oct 24, 2026
Claiming: shared control-char sanitizer for Rich table/explain/error output and the TUI (also fixes TUI markup injection in DataTable/Label cells). Branch: fix/sanitize-terminal-output.
thomaschristory commentedon Oct 24, 2026
PR opened: #207
fix(output,tui): neutralize control sequences and markup in server te…
thomaschristory commentedon Oct 24, 2026
Fixed by #207 (merged). Shipping in v1.9.0.