sanitize IMAP mailbox names before printing to terminal

Malicious mailbox names containing ANSI control sequences could forge
terminal output, alter terminal state, or manipulate clipboard contents.
Wrap f.Mailbox with textutil.SanitizeTerminal() in both printf paths.

Author: mattf

cmd/msgvault/cmd/listfolders.go

@@ -10,6 +10,7 @@ import (
 	imapclient "go.kenn.io/msgvault/internal/imap"
 	"go.kenn.io/msgvault/internal/microsoft"
 	"go.kenn.io/msgvault/internal/store"
+	"go.kenn.io/msgvault/internal/textutil"
 )
 
 func newListFoldersCmd() *cobra.Command {
@@ -140,9 +141,9 @@ func listFolders(ctx context.Context, src *store.Source) error {
 	fmt.Println("  " + strings.Repeat("-", 46))
 	for _, f := range folders {
 		if f.NumMessages == -1 {
-			fmt.Printf("  %-35s %10s\n", f.Mailbox, "??")
+			fmt.Printf("  %-35s %10s\n", textutil.SanitizeTerminal(f.Mailbox), "??")
 		} else {
-			fmt.Printf("  %-35s %10d\n", f.Mailbox, f.NumMessages)
+			fmt.Printf("  %-35s %10d\n", textutil.SanitizeTerminal(f.Mailbox), f.NumMessages)
 		}
 	}
 	fmt.Println()