Terminal Escape Sequence Handling Flaw in App::Ack

Executive Summary

This vulnerability exists in App::Ack versions through 3.10.0 for Perl, where the software prints unsanitised terminal escape sequences from filenames in several output modes.

When ack prints a filename whose basename contains terminal control bytes such as ANSI escape sequences, those bytes are sent to the terminal unchanged.

Although version 3.10.0 added a helper to sanitise filenames printed by some options (-f, -g, colored match heading, and per-match lines), other output paths like --show-types, -l/-L, and -c still output the raw filename.

This means a file with a name embedding cursor-movement or color escape sequences can overwrite or recolor earlier terminal output or be passed unchanged to downstream consumers.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing specially crafted filenames containing terminal control sequences to manipulate terminal output.

Such filenames can overwrite or recolor previous terminal output, potentially misleading users or hiding information.

Additionally, these unsanitised sequences can be passed unchanged to downstream consumers, which might cause unexpected behavior or security issues in other tools processing the output.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, avoid using ack versions through 3.10.0 to print filenames that may contain terminal control bytes such as ANSI escape sequences.

Specifically, be cautious when using the --show-types, -l/-L, and -c options, as these still emit raw filenames without sanitization.

Consider upgrading to a version later than 3.10.0 where the _safe_filename helper sanitizes filenames in most output modes.

As a temporary measure, avoid processing or displaying filenames that may contain terminal control sequences to prevent potential terminal output manipulation.

Useful 0 Not Useful 0