Skip to content
  • Joey Hess's avatar
    filter out control characters in warning messages · 3290a09a
    Joey Hess authored
    Converted warning and similar to use StringContainingQuotedPath. Most
    warnings are static strings, some do refer to filepaths that need to be
    quoted, and others don't need quoting.
    
    Note that, since quote filters out control characters of even
    UnquotedString, this makes all warnings safe, even when an attacker
    sneaks in a control character in some other way.
    
    When json is being output, no quoting is done, since json gets its own
    quoting.
    
    This does, as a side effect, make warning messages in json output not
    be indented. The indentation is only needed to offset warning messages
    underneath the display of the file they apply to, so that's ok.
    
    Sponsored-by: Brett Eisenberg on Patreon
    3290a09a