BE-016 HIGH: the pager emits file-content control bytes verbatim to the tty — ANSI/OSC injection

views/bro/pager.js:145 writes rendered file content to the terminal without neutralizing control bytes, so repo content carrying ESC/CSI/OSC sequences is interpreted by the tty: a hostile (or merely binary) file viewed via cat:/bro/diff can move the cursor, recolor, set the window title, or emit clipboard/OSC-52 sequences. From the 2026-07-07 be/ review (BE/REVIEW), CONFIRMED. Method Issues.

Input

Context

Viewers render untrusted repo bytes; the render path passes control bytes (0x00-0x1F except t/n, 0x7F, and CSI/OSC intro) straight through to fd 1.
git's own defense: caret-notation / replacement for control chars in pager output unless a diff/color layer owns the escape.

Goals

File-content control bytes are neutralized (caret-notation or U+FFFD) at the render boundary; only the view's OWN styling escapes reach the tty.
Applies across the content viewers sharing the pager sink (cat/blob/diff/why/grep).

Constraints

Repro-first (a file with embedded \e]0;pwned\a / CSI → rendered inert); neutralize once at the shared sink, not per view.

WIP

Design decisions

(pending — caret-notation vs replacement char; where in the sink)

TODOs

Repro: control-byte file renders inert.
Neutralize at the render boundary; suite green.

Blockers and bummers

None known.

Outcome

(pending)