safetext

Documentation

Overview

Package safetext provides helpers for defanging attacker-controlled strings before they reach sensitive sinks (mail headers, terminal).

Index

• func SanitizeForTerminal(s string) string
• func SanitizeHeaderValue(v string) string
• func SanitizeSingleLine(s string) string
• func TruncateRunes(s string, max int) string

Functions

func SanitizeForTerminal

func SanitizeForTerminal(s string) string

SanitizeForTerminal strips C0/C1 control characters (including ANSI escape prefix 0x1B) and DEL, preserving tab and newline. Use on attacker-controlled strings (email Subject, From, Body, attachment filename) before printing to a TTY — unfiltered escapes can obscure output, spoof hyperlinks via OSC 8, or manipulate the terminal clipboard via OSC 52.

func SanitizeHeaderValue

func SanitizeHeaderValue(v string) string

SanitizeHeaderValue strips CR and LF from v to prevent RFC 5322 header injection. Call this on any header value derived from untrusted input (e.g., Message-ID, Subject, or From parsed out of received emails) before writing it to an SMTP message or a local RFC 822 message (draft, etc.).

func SanitizeSingleLine

func SanitizeSingleLine(s string) string

SanitizeSingleLine is SanitizeForTerminal plus newline and tab folding, for values rendered as one field of a single line (a Subject or From in the `mail list` table, or a header line in `mail read`).

SanitizeForTerminal deliberately preserves newlines and tabs, which is right for message bodies but not for these fields: an RFC 2047 encoded-word can carry a raw newline through envelope decoding, letting a crafted Subject close its row and forge additional, entirely fake rows in the output. Tabs are folded too because the table is tab-delimited.

func TruncateRunes

func TruncateRunes(s string, max int) string

TruncateRunes shortens s to at most max runes, appending an ellipsis when it had to cut. Truncation is rune-aware: slicing a UTF-8 string by bytes can split a multi-byte character and emit invalid UTF-8.