From 9a95d81f17bb48504698b72ae030447bce71ca0e Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Sat, 14 Feb 2026 16:13:05 +0100
Subject: [PATCH] Strip ANSI and control chars in json_escape & logs

Enhance json_escape to remove ANSI escape sequences (color codes) and other non-printable control characters before escaping backslashes, quotes, newlines, tabs and carriage returns. Also update get_error_text to strip ANSI sequences from tailed logfile output. These changes ensure safe JSON embedding of strings and prevent control characters / terminal color codes from leaking into logs or JSON payloads.
---
 misc/api.func | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/misc/api.func b/misc/api.func
index f8c3aa67e..e4f9d9bf0 100644
--- a/misc/api.func
+++ b/misc/api.func
@@ -237,16 +237,21 @@ explain_exit_code() {
 # json_escape()
 #
 # - Escapes a string for safe JSON embedding
+# - Strips ANSI escape sequences and non-printable control characters
 # - Handles backslashes, quotes, newlines, tabs, and carriage returns
 # ------------------------------------------------------------------------------
 json_escape() {
   local s="$1"
+  # Strip ANSI escape sequences (color codes etc.)
+  s=$(printf '%s' "$s" | sed 's/\x1b\[[0-9;]*[a-zA-Z]//g')
   s=${s//\\/\\\\}
   s=${s//"/\\"/}
   s=${s//$'\n'/\\n}
   s=${s//$'\r'/}
   s=${s//$'\t'/\\t}
-  echo "$s"
+  # Remove any remaining control characters (0x00-0x1F except those already handled)
+  s=$(printf '%s' "$s" | tr -d '\000-\010\013\014\016-\037')
+  printf '%s' "$s"
 }
 
 # ------------------------------------------------------------------------------
@@ -283,7 +288,7 @@ get_error_text() {
   fi
 
   if [[ -n "$logfile" && -s "$logfile" ]]; then
-    tail -n 20 "$logfile" 2>/dev/null | sed 's/\r$//'
+    tail -n 20 "$logfile" 2>/dev/null | sed 's/\r$//' | sed 's/\x1b\[[0-9;]*[a-zA-Z]//g'
   fi
 }