Skip to content

[BUG] Text.from_ansi: NUL byte between ESC and "[" bypasses re_ansi and reaches the terminal as a live escape sequence #4233

Open

Description

@BepuSun

Platform
Tested against rich v15.0.0 with kali's default terminal, qterminal.

Describe the bug
Text.from_ansi uses re_ansi to tokenize ANSI escape sequences. The regex expects ESC (0x1B) to be immediately followed by a recognized byte, so a NUL (0x00) inserted between ESC and "[" prevents a match. _ansi_tokenize then yields the whole sequence as a literal plain-text token.

Text.append() passes it through strip_control_codes(), but that only strips codes 7, 8, 11, 12 and 13, not NUL (0) or ESC (27). The raw ESC NUL [2J bytes therefore survive in the Text and are printed. Many terminal emulators ignore NUL bytes, so they reconstruct and execute the sequence.

PoC
(Note: This will erase the entire terminal. Ensure your terminal has text on the screen to observe the clear-screen command)

from rich.text import Text
msg = "\x1b\x00[2J"
text = Text.from_ansi(msg)
print(text)

Impact
Tools that pass untrusted data (e.g. file contents from a network share) through from_ansi can emit unintended control sequences: screen clearing, cursor movement, and output spoofing.

Suggested fix
The regex could account for NUL after ESC, and strip_control_codes could be extended to also strip NUL bytes that survive outside of a successfully matched sequence, as defense in depth.

Activity

  1. BepuSun commented on Oct 5, 2026

    @BepuSun
    Author

    Happy to submit a PR for this if that would help.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions