Strip terminal controls from server text

client_notification_test.go

@@ -6,6 +6,15 @@ import (
 	"git.stormux.org/storm/barnard/gumble/gumble"
 )
 
+// Regression: HTML escaping left terminal control sequences in server text,
+// allowing ANSI/OSC sequences to alter the terminal that rendered it.
+func TestEscRemovesTerminalControlSequences(t *testing.T) {
+	got := esc("name\x1b]0;spoof\a\x7f\u202e")
+	if got != "name]0;spoof" {
+		t.Fatalf("unsafe terminal text %q", got)
+	}
+}
+
 func TestUserChangeNotification(t *testing.T) {
 	current := &gumble.Channel{ID: 1, Name: "Current"}
 	other := &gumble.Channel{ID: 2, Name: "Other"}