[BACKPORT] Reject illegal paths in OSC 9;9 (#14093)

Paths that contain illegal path components will be dropped
in the dispatcher.

Service-Version: 1.15
(cherry picked from commit fc0ef37)

Service-Version: 1.12

(cherry picked from commit a187987)

Author: DHowett

src/cascadia/TerminalCore/TerminalDispatch.cpp

@@ -542,19 +542,23 @@ bool TerminalDispatch::DoConEmuAction(const std::wstring_view string) noexcept
     {
         if (parts.size() >= 2)
         {
-            const auto path = til::at(parts, 1);
+            auto path = til::at(parts, 1);
             // The path should be surrounded with '"' according to the documentation of ConEmu.
             // An example: 9;"D:/"
-            if (path.at(0) == L'"' && path.at(path.size() - 1) == L'"' && path.size() >= 3)
+            // If we fail to find the surrounding quotation marks, we'll give the path a try anyway.
+            // ConEmu also does this.
+            if (path.size() >= 3 && path.at(0) == L'"' && path.at(path.size() - 1) == L'"')
             {
-                return _terminalApi.SetWorkingDirectory(path.substr(1, path.size() - 2));
+                path = path.substr(1, path.size() - 2);
             }
-            else
+
+            if (!til::is_legal_path(path))
             {
-                // If we fail to find the surrounding quotation marks, we'll give the path a try anyway.
-                // ConEmu also does this.
-                return _terminalApi.SetWorkingDirectory(path);
+                return false;
             }
+
+            _terminalApi.SetWorkingDirectory(path);
+            return true;
         }
     }
 

src/cascadia/UnitTests_TerminalCore/TerminalApiTest.cpp

@@ -436,6 +436,27 @@ void TerminalCoreUnitTests::TerminalApiTest::SetWorkingDirectory()
     stateMachine.ProcessString(L"\x1b]9;9\"C:\\\"\x9c");
     VERIFY_IS_TRUE(term.GetWorkingDirectory().empty());
 
+    stateMachine.ProcessString(L"\x1b"
+                               LR"(]9;9;"C:\invalid path "with" quotes")"
+                               L"\x1b\\");
+    VERIFY_IS_TRUE(term.GetWorkingDirectory().empty());
+
+    // These OSC 9;9 sequences will result in invalid CWD. It should end up empty, like above.
+    stateMachine.ProcessString(L"\x1b]9;9;\"\x1b\\");
+    VERIFY_IS_TRUE(term.GetWorkingDirectory().empty());
+
+    stateMachine.ProcessString(L"\x1b]9;9;\"\"\x1b\\");
+    VERIFY_IS_TRUE(term.GetWorkingDirectory().empty());
+
+    stateMachine.ProcessString(L"\x1b]9;9;\"\"\"\x1b\\");
+    VERIFY_IS_TRUE(term.GetWorkingDirectory().empty());
+
+    stateMachine.ProcessString(L"\x1b]9;9;\"\"\"\"\x1b\\");
+    VERIFY_IS_TRUE(term.GetWorkingDirectory().empty());
+
+    stateMachine.ProcessString(L"\x1b]9;9;No quotes \"until\" later\x1b\\");
+    VERIFY_IS_TRUE(term.GetWorkingDirectory().empty());
+
     // Valid sequences should change CWD
     stateMachine.ProcessString(L"\x1b]9;9;\"C:\\\"\x9c");
     VERIFY_ARE_EQUAL(term.GetWorkingDirectory(), L"C:\\");
@@ -455,17 +476,4 @@ void TerminalCoreUnitTests::TerminalApiTest::SetWorkingDirectory()
 
     stateMachine.ProcessString(L"\x1b]9;9;D:\\中文\x9c");
     VERIFY_ARE_EQUAL(term.GetWorkingDirectory(), L"D:\\中文");
-
-    // These OSC 9;9 sequences will result in invalid CWD. We shouldn't crash on these.
-    stateMachine.ProcessString(L"\x1b]9;9;\"\x9c");
-    VERIFY_ARE_EQUAL(term.GetWorkingDirectory(), L"\"");
-
-    stateMachine.ProcessString(L"\x1b]9;9;\"\"\x9c");
-    VERIFY_ARE_EQUAL(term.GetWorkingDirectory(), L"\"\"");
-
-    stateMachine.ProcessString(L"\x1b]9;9;\"\"\"\x9c");
-    VERIFY_ARE_EQUAL(term.GetWorkingDirectory(), L"\"");
-
-    stateMachine.ProcessString(L"\x1b]9;9;\"\"\"\"\x9c");
-    VERIFY_ARE_EQUAL(term.GetWorkingDirectory(), L"\"\"");
 }

src/inc/til/string.h

@@ -30,6 +30,58 @@ namespace til // Terminal Implementation Library. Also: "Today I Learned"
         return visualize_control_codes(std::wstring{ str });
     }
 
+    namespace details
+    {
+        inline constexpr uint8_t __ = 0b00;
+        inline constexpr uint8_t F_ = 0b10; // stripped in clean_filename
+        inline constexpr uint8_t _P = 0b01; // stripped in clean_path
+        inline constexpr uint8_t FP = 0b11; // stripped in clean_filename and clean_path
+        static constexpr std::array<uint8_t, 128> pathFilter{ {
+            // clang-format off
+            __ /* NUL */, __ /* SOH */, __ /* STX */, __ /* ETX */, __ /* EOT */, __ /* ENQ */, __ /* ACK */, __ /* BEL */, __ /* BS  */, __ /* HT  */, __ /* LF  */, __ /* VT  */, __ /* FF  */, __ /* CR  */, __ /* SO  */, __ /* SI  */,
+            __ /* DLE */, __ /* DC1 */, __ /* DC2 */, __ /* DC3 */, __ /* DC4 */, __ /* NAK */, __ /* SYN */, __ /* ETB */, __ /* CAN */, __ /* EM  */, __ /* SUB */, __ /* ESC */, __ /* FS  */, __ /* GS  */, __ /* RS  */, __ /* US  */,
+            __ /* SP  */, __ /* !   */, FP /* "   */, __ /* #   */, __ /* $   */, __ /* %   */, __ /* &   */, __ /* '   */, __ /* (   */, __ /* )   */, FP /* *   */, __ /* +   */, __ /* ,   */, __ /* -   */, __ /* .   */, F_ /* /   */,
+            __ /* 0   */, __ /* 1   */, __ /* 2   */, __ /* 3   */, __ /* 4   */, __ /* 5   */, __ /* 6   */, __ /* 7   */, __ /* 8   */, __ /* 9   */, F_ /* :   */, __ /* ;   */, FP /* <   */, __ /* =   */, FP /* >   */, FP /* ?   */,
+            __ /* @   */, __ /* A   */, __ /* B   */, __ /* C   */, __ /* D   */, __ /* E   */, __ /* F   */, __ /* G   */, __ /* H   */, __ /* I   */, __ /* J   */, __ /* K   */, __ /* L   */, __ /* M   */, __ /* N   */, __ /* O   */,
+            __ /* P   */, __ /* Q   */, __ /* R   */, __ /* S   */, __ /* T   */, __ /* U   */, __ /* V   */, __ /* W   */, __ /* X   */, __ /* Y   */, __ /* Z   */, __ /* [   */, F_ /* \   */, __ /* ]   */, __ /* ^   */, __ /* _   */,
+            __ /* `   */, __ /* a   */, __ /* b   */, __ /* c   */, __ /* d   */, __ /* e   */, __ /* f   */, __ /* g   */, __ /* h   */, __ /* i   */, __ /* j   */, __ /* k   */, __ /* l   */, __ /* m   */, __ /* n   */, __ /* o   */,
+            __ /* p   */, __ /* q   */, __ /* r   */, __ /* s   */, __ /* t   */, __ /* u   */, __ /* v   */, __ /* w   */, __ /* x   */, __ /* y   */, __ /* z   */, __ /* {   */, FP /* |   */, __ /* }   */, __ /* ~   */, __ /* DEL */,
+            // clang-format on
+        } };
+    }
+
+    _TIL_INLINEPREFIX std::wstring clean_filename(std::wstring str) noexcept
+    {
+        using namespace til::details;
+        str.erase(std::remove_if(std::begin(str), std::end(str), [](auto ch) {
+                      // This lookup is branchless: It always checks the filter, but throws
+                      // away the result if ch >= 128. This is faster than using `&&` (branchy).
+                      return ((til::at(details::pathFilter, ch & 127) & F_) != 0) & (ch < 128);
+                  }),
+                  str.end());
+        return str;
+    }
+
+    _TIL_INLINEPREFIX std::wstring clean_path(std::wstring str) noexcept
+    {
+        using namespace til::details;
+        str.erase(std::remove_if(std::begin(str), std::end(str), [](auto ch) {
+                      return ((til::at(details::pathFilter, ch & 127) & _P) != 0) & (ch < 128);
+                  }),
+                  str.end());
+        return str;
+    }
+
+    // is_legal_path rules on whether a path contains any non-path characters.
+    // it **DOES NOT** rule on whether a path exists.
+    _TIL_INLINEPREFIX constexpr bool is_legal_path(const std::wstring_view str) noexcept
+    {
+        using namespace til::details;
+        return !std::any_of(std::begin(str), std::end(str), [](auto&& ch) {
+            return ((til::at(details::pathFilter, ch & 127) & _P) != 0) & (ch < 128);
+        });
+    }
+
     // std::string_view::starts_with support for C++17.
     template<typename T, typename Traits>
     constexpr bool starts_with(const std::basic_string_view<T, Traits>& str, const std::basic_string_view<T, Traits>& prefix) noexcept

src/til/ut_til/string.cpp

@@ -169,4 +169,10 @@ class StringTests
             VERIFY_ARE_EQUAL("", s);
         }
     }
+
+    TEST_METHOD(LegalPath)
+    {
+        VERIFY_IS_TRUE(til::is_legal_path(LR"(C:\Users\Documents and Settings\Users\;\Why not)"));
+        VERIFY_IS_FALSE(til::is_legal_path(LR"(C:\Users\Documents and Settings\"Quote-un-quote users")"));
+    }
 };