This PR replaces the escapeString function with the more stricter quoting done by strconv. Previously, special non-printable characters such as bash escape characters could be allowed through. Such characters can change the terminal colour, break lines, delete previously printed characters etc, and may represent a security vulnerability in the application using this library.
This PR does change API a bit, since previously log15 did not quote all messages, if they were deemed to not require quoting. It would be possible to revert that change, but I actually think it's better to be consistent, so I didn't add the extra checks to see if the value should be un-quoted again.
This PR now avoids quoting messages that are plain lower range ascii. It does now quote otherwise printable messages with characters like äö, which was not previously quoted.
This PR replaces the
escapeStringfunction with the more stricter quoting done bystrconv. Previously, special non-printable characters such as bash escape characters could be allowed through. Such characters can change the terminal colour, break lines, delete previously printed characters etc, and may represent a security vulnerability in the application using this library.This PR does change API a bit, since previously log15 did not quote all messages, if they were deemed to not require quoting. It would be possible to revert that change, but I actually think it's better to be consistent, so I didn't add the extra checks to see if the value should be un-quoted again.This PR now avoids quoting messages that are plain lower range ascii. It does now quote otherwise printable messages with characters like
äö, which was not previously quoted.