Strip control characters out of a string that originates in an
attacker-controlled response — the ArcGIS error detail and the non-JSON body
snippet — before it flows into a RegionalatlasApiError.message that run.ts
prints raw to stderr. JSON.parse decodes an escaped ESC (a backslash-u-001b
sequence) in an error body into a real ESC byte, so without this a hostile or
MITM'd endpoint could inject
ANSI/OSC terminal escape sequences (screen clears, title changes, output
spoofing) when the message reaches the user's terminal. The CLI's JSON output is
escaped separately (escapeControlChars in cli/shared.ts), as JSON.stringify
alone leaves DEL and the C1 range raw. Removes all C0 controls (except
tab/newline), DEL, and the C1 range; implemented via char codes so this source
file never contains a raw control byte.
Strip control characters out of a string that originates in an attacker-controlled response — the ArcGIS
errordetail and the non-JSON body snippet — before it flows into aRegionalatlasApiError.messagethat run.ts prints raw to stderr.JSON.parsedecodes an escaped ESC (a backslash-u-001b sequence) in an error body into a real ESC byte, so without this a hostile or MITM'd endpoint could inject ANSI/OSC terminal escape sequences (screen clears, title changes, output spoofing) when the message reaches the user's terminal. The CLI's JSON output is escaped separately (escapeControlCharsin cli/shared.ts), asJSON.stringifyalone leaves DEL and the C1 range raw. Removes all C0 controls (except tab/newline), DEL, and the C1 range; implemented via char codes so this source file never contains a raw control byte.