urwid / urwid / 37012579990

91%

push

github

Bound ANSI parser work on untrusted input (#1382)

ANSIText parses untrusted terminal output, and short sequences could
allocate gigabytes, raise, flood stderr or grow internal lists without
limit:

- Relative cursor moves advance at most 1024 cells per sequence, and
  absolute moves stop at row/column 1024.
- Padding inserted by cursor moves is limited to 1024 * 1024 cells plus
  8 per fed character over the parser's lifetime; an inserted empty row
  counts as 8 cells. Past the limit a character is written at the end
  of its row, a move below the last row stays on it, and the cut is
  recorded as a skipped sequence.
- CSI parameters over 256 characters are skipped, so int() never
  rejects one.
- OSC strings of 4096 characters or more are skipped, and the rest is
  discarded up to the terminator without buffering.
- Escape buffers and padding no longer grow quadratically in time.
- SGR 38/48 colours outside 0..255 are ignored instead of raising
  AttrSpecError; this also fixes the Terminal widget.
- ParsedLine.skipped keeps the first 65536 entries, per line in
  one_line mode and over the whole input otherwise.
- Skipped sequences are logged at DEBUG instead of WARNING/INFO.

| what | before | after | percent change |
| --- | --- | --- | --- |
| AnsiParser.feed peak memory, 1 MB, screen mode | 1225.9 MB | 120.9 MB | -90.1% |
| AnsiParser.feed peak memory, 1 MB, one_line | 161.0 MB | 66.8 MB | -58.5% |
| AnsiParser.feed time, 1 MB, screen mode | 57.79 s | 5.13 s | -91.1% |

4572 of 5504 branches covered (83.07%)

Branch coverage included in aggregate %.

57 of 59 new or added lines in 1 file covered. (96.61%)

11472 of 13100 relevant lines covered (87.57%)

9.78 hits per line