Support for ansi terminal links about ansi_up

[drudru]

Ok - pushed out the npm release. Thanks to all for your help.

[drudru]

This is awesome!

I'm happy to add support for this. In progress...

👍

[drudru]

Hi - quick update. Made some good progress over the last few days. More soon.

[drudru]

@LaKing - ok - code for testing is up on master. It required a lot of changes, but we were due for that anyways 👍

I will be cleaning it up and revising the Readme tomorrow.
The big difference is that there is only ansi_to_html now.

Lmk if you have any comments on the functionality.

[LaKing]

One more thing.

The URL part seems to rely on the protocol prefix, eg. http or https, thus relative links for example are not parsed, but left out empty. (no html at all)

[drudru]

@alech - thx, will investigate

[drudru]

@alech - ok, have time this week to work on all these issues. Updates soon.

[drudru]

Hi - I am not aware of this new tagging feature. Can you point me at where this is documented?
Which terminals support this?

If this is a new convention, that is great news. We could bring back the linkify code.

[LaKing]

The best documentation found so far is this.

I'm using GNOME on Fedora, and I can confirm both of the above examples work.

JS example to create terminal links:
terminal-link (listed also on the bottom of chalk)
Sample is index.js from
hyperlinker

[drudru]

Just an update. This is going to require a bit of work. However, that is ok. Now is a good time to clean up other parts as well.

[LaKing]

Great!

This is my library of choice .) ...
.. let me know if I can help!

[LaKing]

Works great!

Updated my code, and found no issues so far.

Thank you very much!

The only thing left is an update on the readme, and publishing it to npm. .)

[LaKing]

Oopps, .. It works for the node way of creating links, but the bash way seems to left untouched as text.

[LaKing]

Okay, I found a bug I think.

If the text part has a space, it breaks.

Problematic code "link 12" with a space

^[[34m^[]8;;http://example.com^Glink 12^[]8;;^G^[[0m

Working code "link:12" with no spaces

^[[34m^[]8;;http://example.com^Glink:12^[]8;;^G^[[0m

Both of these work in the terminal, but the problematic html output is

<span>]8;;http://example.com�link 12</span><span>]8;;�</span>

By the way, the alternative bash code for writing links similar way as the node code does (with \a)

## standard
echo -e '\e]8;;http://example.com\aThis is a link\e]8;;\a'
## colored
echo -e '\e[34m\e]8;;http://example.com\aThis is a link\e]8;;\a\e[0m' 

[alech]

The current implementation is prone to a DOM-based XSS attack. Since the URL parameter allows \x21-\x7e characters and the URL gets inserted into href attribute without filtering, an attacker can close the a tag and add (nearly) arbitrary HTML into the return value of process_hyperlink. I would suggest actually parsing the URL with new URL and then using the href attribute of the result in order to be safe (plus the filtering of the schemes which is already in place and is a good feature could then be made more robust).

PoC:

    var txt = ' \x1b]8;;http://example.com"></a><img/src="foo"onerror=alert(1)><pp\x1b\\.\x1b]8;;\x1b\\ ';

    var ansi_up = new AnsiUp;
    var html = ansi_up.ansi_to_html(txt);
    var cdiv = document.getElementById("console");
    cdiv.innerHTML = html;

[drudru]

I'm keeping this issue open for a few more days. Once I push the NPM, then I will close the issue.