security: strip deceptive Unicode characters from terminal output (#19026)

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
This commit is contained in:
Emily Hedlund
2026-02-20 15:04:32 -05:00
committed by GitHub
parent 7cf4c05c66
commit aed348a99c
7 changed files with 109 additions and 11 deletions

View File

@@ -8,6 +8,7 @@ import React from 'react';
import { Text } from 'ink';
import { theme } from '../semantic-colors.js';
import { debugLogger } from '@google/gemini-cli-core';
import { stripUnsafeCharacters } from './textUtils.js';
// Constants for Markdown parsing
const BOLD_MARKER_LENGTH = 2; // For "**"
@@ -23,9 +24,10 @@ interface RenderInlineProps {
}
const RenderInlineInternal: React.FC<RenderInlineProps> = ({
text,
text: rawText,
defaultColor,
}) => {
const text = stripUnsafeCharacters(rawText);
const baseColor = defaultColor ?? theme.text.primary;
// Early return for plain text without markdown or URLs
if (!/[*_~`<[https?:]/.test(text)) {