You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
[BUG] Text.from_ansi: NUL byte between ESC and "[" bypasses re_ansi and reaches the terminal as a live escape sequence #4233
Platform
Tested against rich v15.0.0 with kali's default terminal, qterminal.
Describe the bug Text.from_ansi uses re_ansi to tokenize ANSI escape sequences. The regex expects ESC (0x1B) to be immediately followed by a recognized byte, so a NUL (0x00) inserted between ESC and "[" prevents a match. _ansi_tokenize then yields the whole sequence as a literal plain-text token.
Text.append() passes it through strip_control_codes(), but that only strips codes 7, 8, 11, 12 and 13, not NUL (0) or ESC (27). The raw ESC NUL [2J bytes therefore survive in the Text and are printed. Many terminal emulators ignore NUL bytes, so they reconstruct and execute the sequence.
PoC
(Note: This will erase the entire terminal. Ensure your terminal has text on the screen to observe the clear-screen command)
from rich.text import Text
msg = "\x1b\x00[2J"
text = Text.from_ansi(msg)
print(text)
Impact
Tools that pass untrusted data (e.g. file contents from a network share) through from_ansi can emit unintended control sequences: screen clearing, cursor movement, and output spoofing.
Suggested fix
The regex could account for NUL after ESC, and strip_control_codes could be extended to also strip NUL bytes that survive outside of a successfully matched sequence, as defense in depth.
Activity
BepuSun commentedon Oct 5, 2026
Happy to submit a PR for this if that would help.