My Rust TUI Let Any Local User Write to My Terminal

说明与用途

任何本地用户都可以通过进程名称、命令行或日志消息注入终端转义序列，导致终端执行意外操作。0.3.0 版本对所有输出进行清理，并正确处理非 UTF‑8 名称，防止此类问题。

问题

Any local user can inject terminal escape sequences into tuxctl’s output by setting a process name, command line, or journal message containing control characters, causing unintended terminal actions such as clipboard writes or resets.

结果

The vulnerability allowed local users to inject terminal escape sequences via process names, command lines, or journal messages. The fix sanitizes all output and handles non‑UTF‑8 names, preventing unintended terminal actions.

工作流

• Identify that process names, command lines, and journal messages can contain arbitrary bytes.
• Observe that Ratatui removes only newlines, so ESC bytes reach the terminal.
• Realize that any local user can set a process name via prctl or a command line, or write a journal message with logger.
• Run a demo script that sets a process name to an escape sequence that changes the terminal title.
• Perform a security review of v0.3.0, discovering the bug and a second bug where non‑UTF‑8 names were dropped.
• Implement sanitization of all drawn text and lossless reading of /proc/<pid>/stat.
• Release v0.3.0 with the fixes and no new dependencies.
• Provide a checklist for TUI/CLI developers to avoid similar issues.
• Advise users to upgrade to v0.3.0 or later.

证据

any local user could make tuxctl write arbitrary bytes to my terminal

来源

When Ratatui renders a span, it removes newline characters and nothing else.

来源

v0.3.0 now removes control characters and bidirectional overrides from everything tuxctl draws.

来源

For the second bug, /proc/<pid>/stat is now read lossily.

来源