<feed xmlns='http://www.w3.org/2005/Atom'>
<title>st, branch 0.8.4</title>
<subtitle>a modified version of st (simple terminal)</subtitle>
<link rel='alternate' type='text/html' href='http://git.yctct.com/st/'/>
<entry>
<title>bump version to 0.8.4</title>
<updated>2020-06-19T09:27:17+00:00</updated>
<author>
<name>Hiltjo Posthuma</name>
<email>hiltjo@codemadness.org</email>
</author>
<published>2020-06-19T09:27:17+00:00</published>
<link rel='alternate' type='text/html' href='http://git.yctct.com/st/commit/?id=fa253f077f19b3220c7655b81bd91e52f4367803'/>
<id>fa253f077f19b3220c7655b81bd91e52f4367803</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>config.mk: use PKG_CONFIG in commented OpenBSD section</title>
<updated>2020-06-17T21:49:40+00:00</updated>
<author>
<name>Hiltjo Posthuma</name>
<email>hiltjo@codemadness.org</email>
</author>
<published>2020-06-17T21:47:00+00:00</published>
<link rel='alternate' type='text/html' href='http://git.yctct.com/st/commit/?id=b27a383a3acc7decf00e6e889fca265430b5d329'/>
<id>b27a383a3acc7decf00e6e889fca265430b5d329</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>LICENSE: bump years</title>
<updated>2020-06-17T21:49:40+00:00</updated>
<author>
<name>Hiltjo Posthuma</name>
<email>hiltjo@codemadness.org</email>
</author>
<published>2020-06-17T21:44:34+00:00</published>
<link rel='alternate' type='text/html' href='http://git.yctct.com/st/commit/?id=81067c65ea4dd80e8eb34755a4f50a4a8c7df06b'/>
<id>81067c65ea4dd80e8eb34755a4f50a4a8c7df06b</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>remove sixel stub code</title>
<updated>2020-06-17T21:49:22+00:00</updated>
<author>
<name>Hiltjo Posthuma</name>
<email>hiltjo@codemadness.org</email>
</author>
<published>2020-06-17T20:05:48+00:00</published>
<link rel='alternate' type='text/html' href='http://git.yctct.com/st/commit/?id=f74a9df6e1fc88eebe6d673d888b61fd83cf6fc4'/>
<id>f74a9df6e1fc88eebe6d673d888b61fd83cf6fc4</id>
<content type='text'>
Remove stub code that was used for an experiment of adding sixel code to st
from the commit f7398434.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Remove stub code that was used for an experiment of adding sixel code to st
from the commit f7398434.
</pre>
</div>
</content>
</entry>
<entry>
<title>fix unicode glitch in DCS strings, patch by Tim Allen</title>
<updated>2020-06-17T19:35:39+00:00</updated>
<author>
<name>Hiltjo Posthuma</name>
<email>hiltjo@codemadness.org</email>
</author>
<published>2020-06-17T19:35:39+00:00</published>
<link rel='alternate' type='text/html' href='http://git.yctct.com/st/commit/?id=818ec746f4caae453d09368b101c3e841cf39870'/>
<id>818ec746f4caae453d09368b101c3e841cf39870</id>
<content type='text'>
Reported on the mailinglist:

"
I discovered recently that if an application running inside st tries to
send a DCS string, subsequent Unicode characters get messed up. For
example, consider the following test-case:

    printf '\303\277\033P\033\\\303\277'

...where:

  - \303\277 is the UTF-8 encoding of U+00FF LATIN SMALL LETTER Y WITH
    DIAERESIS (ÿ).
  - \033P is ESC P, the token that begins a DCS string.
  - \033\\ is ESC \, a token that ends a DCS string.
  - \303\277 is the same ÿ character again.

If I run the above command in a VTE-based terminal, or xterm, or
QTerminal, or pterm (PuTTY), I get the output:

    ÿÿ

...which is to say, the empty DCS string is ignored. However, if I run
that command inside st (as of commit 9ba7ecf), I get:

    ÿÃ¿

...where those last two characters are \303\277 interpreted as ISO8859-1
characters, instead of UTF-8.

I spent some time tracing through the state machines in st.c, and so far
as I can tell, this is how it works currently:

  - ESC P sets the "ESC_DCS" and "ESC_STR" flags, indicating that
    incoming bytes should be collected into the strescseq buffer, rather
    than being interpreted.
  - ESC \ sets the "ESC_STR_END" flag (when ESC is received), and then
    calls strhandle() (when \ is received) to interpret the collected
    bytes.
  - If the collected bytes begin with 'P' (i.e. if this was a DCS
    string) strhandle() sets the "ESC_DCS" flag again, confusing the
    state machine.

If my understanding is correct, fixing the problem should be as easy as
removing the line that sets ESC_DCS from strhandle():

diff --git a/st.c b/st.c
index ef8abd5..b5b805a 100644
--- a/st.c
+++ b/st.c
@@ -1897,7 +1897,6 @@ strhandle(void)
		xsettitle(strescseq.args[0]);
		return;
	case 'P': /* DCS -- Device Control String */
-		term.mode |= ESC_DCS;
	case '_': /* APC -- Application Program Command */
	case '^': /* PM -- Privacy Message */
		return;

I've tried the above patch and it fixes my problem, but I don't know if
it introduces any others.
"
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Reported on the mailinglist:

"
I discovered recently that if an application running inside st tries to
send a DCS string, subsequent Unicode characters get messed up. For
example, consider the following test-case:

    printf '\303\277\033P\033\\\303\277'

...where:

  - \303\277 is the UTF-8 encoding of U+00FF LATIN SMALL LETTER Y WITH
    DIAERESIS (ÿ).
  - \033P is ESC P, the token that begins a DCS string.
  - \033\\ is ESC \, a token that ends a DCS string.
  - \303\277 is the same ÿ character again.

If I run the above command in a VTE-based terminal, or xterm, or
QTerminal, or pterm (PuTTY), I get the output:

    ÿÿ

...which is to say, the empty DCS string is ignored. However, if I run
that command inside st (as of commit 9ba7ecf), I get:

    ÿÃ¿

...where those last two characters are \303\277 interpreted as ISO8859-1
characters, instead of UTF-8.

I spent some time tracing through the state machines in st.c, and so far
as I can tell, this is how it works currently:

  - ESC P sets the "ESC_DCS" and "ESC_STR" flags, indicating that
    incoming bytes should be collected into the strescseq buffer, rather
    than being interpreted.
  - ESC \ sets the "ESC_STR_END" flag (when ESC is received), and then
    calls strhandle() (when \ is received) to interpret the collected
    bytes.
  - If the collected bytes begin with 'P' (i.e. if this was a DCS
    string) strhandle() sets the "ESC_DCS" flag again, confusing the
    state machine.

If my understanding is correct, fixing the problem should be as easy as
removing the line that sets ESC_DCS from strhandle():

diff --git a/st.c b/st.c
index ef8abd5..b5b805a 100644
--- a/st.c
+++ b/st.c
@@ -1897,7 +1897,6 @@ strhandle(void)
		xsettitle(strescseq.args[0]);
		return;
	case 'P': /* DCS -- Device Control String */
-		term.mode |= ESC_DCS;
	case '_': /* APC -- Application Program Command */
	case '^': /* PM -- Privacy Message */
		return;

I've tried the above patch and it fixes my problem, but I don't know if
it introduces any others.
"
</pre>
</div>
</content>
</entry>
<entry>
<title>FAQ: fix single-buffer patch</title>
<updated>2020-06-01T12:09:46+00:00</updated>
<author>
<name>Hiltjo Posthuma</name>
<email>hiltjo@codemadness.org</email>
</author>
<published>2020-06-01T12:09:46+00:00</published>
<link rel='alternate' type='text/html' href='http://git.yctct.com/st/commit/?id=9ba7ecf7b15ec2986c6142036706aa353b249ef9'/>
<id>9ba7ecf7b15ec2986c6142036706aa353b249ef9</id>
<content type='text'>
rebase against master
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
rebase against master
</pre>
</div>
</content>
</entry>
<entry>
<title>config.def.h: add an option allowwindowops, by default off (secure)</title>
<updated>2020-05-30T20:06:15+00:00</updated>
<author>
<name>Hiltjo Posthuma</name>
<email>hiltjo@codemadness.org</email>
</author>
<published>2020-05-30T19:56:18+00:00</published>
<link rel='alternate' type='text/html' href='http://git.yctct.com/st/commit/?id=a2a704492b9f4d2408d180f7aeeacf4c789a1d67'/>
<id>a2a704492b9f4d2408d180f7aeeacf4c789a1d67</id>
<content type='text'>
Similar to the xterm AllowWindowOps option, this is an option to allow or
disallow certain (non-interactive) operations that can be insecure or
exploited.

NOTE: xsettitle() is not guarded by this because st does not support printing
the window title. Else this could be exploitable (arbitrary code execution).
Similar problems have been found in the past in other terminal emulators.

The sequence for base64-encoded clipboard copy is now guarded because it allows
a sequence written to the terminal to manipulate the clipboard of the running
user non-interactively, for example:

printf '\x1b]52;0;ZWNobyBoaQ0=\a'
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Similar to the xterm AllowWindowOps option, this is an option to allow or
disallow certain (non-interactive) operations that can be insecure or
exploited.

NOTE: xsettitle() is not guarded by this because st does not support printing
the window title. Else this could be exploitable (arbitrary code execution).
Similar problems have been found in the past in other terminal emulators.

The sequence for base64-encoded clipboard copy is now guarded because it allows
a sequence written to the terminal to manipulate the clipboard of the running
user non-interactively, for example:

printf '\x1b]52;0;ZWNobyBoaQ0=\a'
</pre>
</div>
</content>
</entry>
<entry>
<title>FAQ: add some details about the w3m img hack</title>
<updated>2020-05-30T20:05:17+00:00</updated>
<author>
<name>Hiltjo Posthuma</name>
<email>hiltjo@codemadness.org</email>
</author>
<published>2020-05-30T19:50:54+00:00</published>
<link rel='alternate' type='text/html' href='http://git.yctct.com/st/commit/?id=0f8b40652bca0670f1f0bda069bbc55f8b5e364d'/>
<id>0f8b40652bca0670f1f0bda069bbc55f8b5e364d</id>
<content type='text'>
... and an example patch to switch from double-buffering to a single buffer.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
... and an example patch to switch from double-buffering to a single buffer.
</pre>
</div>
</content>
</entry>
<entry>
<title>tiny style fix</title>
<updated>2020-05-30T20:05:17+00:00</updated>
<author>
<name>Hiltjo Posthuma</name>
<email>hiltjo@codemadness.org</email>
</author>
<published>2020-05-30T19:39:49+00:00</published>
<link rel='alternate' type='text/html' href='http://git.yctct.com/st/commit/?id=e6e2c6199f102f1459b53717050eee27832f4f87'/>
<id>e6e2c6199f102f1459b53717050eee27832f4f87</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>Partially add back in "support REP (repeat) escape sequence"</title>
<updated>2020-05-30T20:04:28+00:00</updated>
<author>
<name>Hiltjo Posthuma</name>
<email>hiltjo@codemadness.org</email>
</author>
<published>2020-05-30T19:34:57+00:00</published>
<link rel='alternate' type='text/html' href='http://git.yctct.com/st/commit/?id=94b8ec002101a5e8f52a342e53431eea71aa0631'/>
<id>94b8ec002101a5e8f52a342e53431eea71aa0631</id>
<content type='text'>
Add the functionality back in for xterm compatibility, but do not expose the
capability in st.info (yet).

Some notes:

It was reverted because it caused some issues with ncurses in some
configurations, namely when using BSD padding (--enable-bsdpad, BSD_TPUTS) in
ncurses it caused issues with repeating digits.

A fix has been upstreamed in ncurses since snapshot 20200523. The fix is also
backported to OpenBSD -current.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Add the functionality back in for xterm compatibility, but do not expose the
capability in st.info (yet).

Some notes:

It was reverted because it caused some issues with ncurses in some
configurations, namely when using BSD padding (--enable-bsdpad, BSD_TPUTS) in
ncurses it caused issues with repeating digits.

A fix has been upstreamed in ncurses since snapshot 20200523. The fix is also
backported to OpenBSD -current.
</pre>
</div>
</content>
</entry>
</feed>
