Sanitize names rendered in the channel tree

client_notification_test.go

@@ -55,6 +55,15 @@ func TestNotificationExpansionIsSinglePassAndNotifyDoesNotBlock(t *testing.T) {
 
 // Regression: reconnect replaced Stream without destroying the old capture
 // and renderer resources. Cleanup must be safe for repeated disconnects.
+// Regression: user and channel names in the navigation tree bypassed message
+// escaping and could still carry terminal control characters.
+func TestTreeItemSanitizesServerNames(t *testing.T) {
+	item := TreeItem{Channel: &gumble.Channel{Name: "\x1b[2Jroom"}}
+	if got := item.String(); got != "#[2Jroom" {
+		t.Fatalf("got %q", got)
+	}
+}
+
 func TestCleanupConnectionAudioIsIdempotent(t *testing.T) {
 	b := &Barnard{}
 	b.cleanupConnectionAudio()