Be more strict about what names and titles we allow and reject them

immediately when possible, but allow # again for those directly set by
commands (but not escape sequences). From Barrett Ruth in GitHub issue
5175.

cmd-break-pane.c

@@ -58,9 +58,14 @@ cmd_break_pane_exec(struct cmd *self, struct cmdq_item *item)
 	struct session		*dst_s = target->s;
 	struct window_pane	*wp = source->wp;
 	struct window		*w = wl->window;
-	char			*name, *cause, *cp;
+	char			*newname, *cause, *cp;
 	int			 idx = target->idx, before;
-	const char		*template;
+	const char		*template, *name = args_get(args, 'n');
+
+	if (name != NULL && !check_name(name, WINDOW_NAME_FORBID)) {
+		cmdq_error(item, "invalid window name: %s", name);
+		return (CMD_RETURN_ERROR);
+	}
 
 	before = args_has(args, 'b');
 	if (args_has(args, 'a') || before) {
@@ -80,8 +85,8 @@ cmd_break_pane_exec(struct cmd *self, struct cmdq_item *item)
 			free(cause);
 			return (CMD_RETURN_ERROR);
 		}
-		if (args_has(args, 'n')) {
-			window_set_name(w, args_get(args, 'n'));
+		if (name != NULL) {
+			window_set_name(w, name, WINDOW_NAME_FORBID);
 			options_set_number(w->options, "automatic-rename", 0);
 		}
 		server_unlink_window(src_s, wl);
@@ -109,12 +114,12 @@ cmd_break_pane_exec(struct cmd *self, struct cmdq_item *item)
 	w->active = wp;
 	w->latest = tc;
 
-	if (!args_has(args, 'n')) {
-		name = default_window_name(w);
-		window_set_name(w, name);
-		free(name);
+	if (name != NULL) {
+		newname = default_window_name(w);
+		window_set_name(w, newname, WINDOW_NAME_FORBID);
+		free(newname);
 	} else {
-		window_set_name(w, args_get(args, 'n'));
+		window_set_name(w, name, 0);
 		options_set_number(w->options, "automatic-rename", 0);
 	}
 

cmd-new-session.c

@@ -77,8 +77,8 @@ cmd_new_session_exec(struct cmd *self, struct cmdq_item *item)
 	struct termios		 tio, *tiop;
 	struct session_group	*sg = NULL;
 	const char		*errstr, *template, *group, *tmp;
-	char			*cause, *cwd = NULL, *cp, *newname = NULL;
-	char			*name, *prefix = NULL;
+	char			*cause, *cwd = NULL, *cp, *ename;
+	char			*wname = NULL, *sname = NULL, *prefix = NULL;
 	int			 detached, already_attached, is_control = 0;
 	u_int			 sx, sy, dsx, dsy, count = args_count(args);
 	struct spawn_context	 sc = { 0 };
@@ -99,20 +99,29 @@ cmd_new_session_exec(struct cmd *self, struct cmdq_item *item)
 		return (CMD_RETURN_ERROR);
 	}
 
-	tmp = args_get(args, 's');
-	if (tmp != NULL) {
-		name = format_single(item, tmp, c, NULL, NULL, NULL);
-		newname = clean_name(name, "#:.");
-		if (newname == NULL) {
-			cmdq_error(item, "invalid session: %s", name);
-			free(name);
+	if ((tmp = args_get(args, 'n')) != NULL) {
+		ename = format_single(item, tmp, c, NULL, NULL, NULL);
+		if (!check_name(ename, WINDOW_NAME_FORBID)) {
+			cmdq_error(item, "invalid window name: %s", ename);
+			free(ename);
 			return (CMD_RETURN_ERROR);
 		}
-		free(name);
+		wname = clean_name(ename, WINDOW_NAME_FORBID);
+		free(ename);
+	}
+	if ((tmp = args_get(args, 's')) != NULL) {
+		ename = format_single(item, tmp, c, NULL, NULL, NULL);
+		if (!check_name(ename, SESSION_NAME_FORBID)) {
+			cmdq_error(item, "invalid session name: %s", ename);
+			free(ename);
+			goto fail;
+		}
+		sname = clean_name(ename, SESSION_NAME_FORBID);
+		free(ename);
 	}
 	if (args_has(args, 'A')) {
-		if (newname != NULL)
-			as = session_find(newname);
+		if (sname != NULL)
+			as = session_find(sname);
 		else
 			as = target->s;
 		if (as != NULL) {
@@ -120,12 +129,13 @@ cmd_new_session_exec(struct cmd *self, struct cmdq_item *item)
 			    args_has(args, 'D'), args_has(args, 'X'), 0,
 			    args_get(args, 'c'), args_has(args, 'E'),
 			    args_get(args, 'f'));
-			free(newname);
+			free(wname);
+			free(sname);
 			return (retval);
 		}
 	}
-	if (newname != NULL && session_find(newname) != NULL) {
-		cmdq_error(item, "duplicate session: %s", newname);
+	if (sname != NULL && session_find(sname) != NULL) {
+		cmdq_error(item, "duplicate session: %s", sname);
 		goto fail;
 	}
 
@@ -142,12 +152,12 @@ cmd_new_session_exec(struct cmd *self, struct cmdq_item *item)
 		else if (groupwith != NULL)
 			prefix = xstrdup(groupwith->name);
 		else {
-			prefix = clean_name(group, "#:.");
-			if (prefix == NULL) {
-				cmdq_error(item, "invalid session group: %s",
-				    group);
+			if (!check_name(group, SESSION_NAME_FORBID)) {
+				cmdq_error(item,
+				    "invalid session group name: %s", group);
 				goto fail;
 			}
+			prefix = clean_name(group, SESSION_NAME_FORBID);
 		}
 	}
 
@@ -276,7 +286,7 @@ cmd_new_session_exec(struct cmd *self, struct cmdq_item *item)
 		environ_put(env, av->string, 0);
 		av = args_next_value(av);
 	}
-	s = session_create(prefix, newname, cwd, env, oo, tiop);
+	s = session_create(prefix, sname, cwd, env, oo, tiop);
 
 	/* Spawn the initial window. */
 	sc.item = item;
@@ -284,7 +294,7 @@ cmd_new_session_exec(struct cmd *self, struct cmdq_item *item)
 	if (!detached)
 		sc.tc = c;
 
-	sc.name = args_get(args, 'n');
+	sc.name = wname;
 	args_to_vector(args, &sc.argc, &sc.argv);
 
 	sc.idx = -1;
@@ -357,7 +367,8 @@ cmd_new_session_exec(struct cmd *self, struct cmdq_item *item)
 	if (sc.argv != NULL)
 		cmd_free_argv(sc.argc, sc.argv);
 	free(cwd);
-	free(newname);
+	free(wname);
+	free(sname);
 	free(prefix);
 	return (CMD_RETURN_NORMAL);
 
@@ -365,7 +376,8 @@ fail:
 	if (sc.argv != NULL)
 		cmd_free_argv(sc.argc, sc.argv);
 	free(cwd);
-	free(newname);
+	free(wname);
+	free(sname);
 	free(prefix);
 	return (CMD_RETURN_ERROR);
 }

cmd-new-window.c

@@ -61,7 +61,7 @@ cmd_new_window_exec(struct cmd *self, struct cmdq_item *item)
 	struct session		*s = target->s;
 	struct winlink		*wl = target->wl, *new_wl = NULL;
 	int			 idx = target->idx, before;
-	char			*cause = NULL, *cp, *expanded;
+	char			*cause = NULL, *cp, *expanded, *wname;
 	const char		*template, *name;
 	struct cmd_find_state	 fs;
 	struct args_value	*av;
@@ -71,8 +71,18 @@ cmd_new_window_exec(struct cmd *self, struct cmdq_item *item)
 	 * name already exists, select it.
 	 */
 	name = args_get(args, 'n');
-	if (args_has(args, 'S') && name != NULL && target->idx == -1) {
+	if (name != NULL) {
 		expanded = format_single(item, name, c, s, NULL, NULL);
+		if (!check_name(expanded, WINDOW_NAME_FORBID)) {
+			cmdq_error(item, "invalid window name: %s", expanded);
+			free(expanded);
+			return (CMD_RETURN_ERROR);
+		}
+		wname = clean_name(expanded, WINDOW_NAME_FORBID);
+		free(expanded);
+	}
+	if (args_has(args, 'S') && wname != NULL && target->idx == -1) {
+		expanded = format_single(item, wname, c, s, NULL, NULL);
 		RB_FOREACH(wl, winlinks, &s->windows) {
 			if (strcmp(wl->window->name, expanded) != 0)
 				continue;
@@ -80,12 +90,14 @@ cmd_new_window_exec(struct cmd *self, struct cmdq_item *item)
 				new_wl = wl;
 				continue;
 			}
-			cmdq_error(item, "multiple windows named %s", name);
+			cmdq_error(item, "multiple windows named %s", wname);
+			free(wname);
 			free(expanded);
 			return (CMD_RETURN_ERROR);
 		}
 		free(expanded);
 		if (new_wl != NULL) {
+			free(wname);
 			if (args_has(args, 'd'))
 				return (CMD_RETURN_NORMAL);
 			if (session_set_current(s, new_wl) == 0)
@@ -108,7 +120,7 @@ cmd_new_window_exec(struct cmd *self, struct cmdq_item *item)
 	sc.s = s;
 	sc.tc = tc;
 
-	sc.name = args_get(args, 'n');
+	sc.name = wname;
 	args_to_vector(args, &sc.argc, &sc.argv);
 	sc.environ = environ_create();
 
@@ -130,10 +142,7 @@ cmd_new_window_exec(struct cmd *self, struct cmdq_item *item)
 	if ((new_wl = spawn_window(&sc, &cause)) == NULL) {
 		cmdq_error(item, "create window failed: %s", cause);
 		free(cause);
-		if (sc.argv != NULL)
-			cmd_free_argv(sc.argc, sc.argv);
-		environ_free(sc.environ);
-		return (CMD_RETURN_ERROR);
+		goto fail;
 	}
 	if (!args_has(args, 'd') || new_wl == s->curw) {
 		cmd_find_from_winlink(current, new_wl, 0);
@@ -156,5 +165,13 @@ cmd_new_window_exec(struct cmd *self, struct cmdq_item *item)
 	if (sc.argv != NULL)
 		cmd_free_argv(sc.argc, sc.argv);
 	environ_free(sc.environ);
+	free(wname);
 	return (CMD_RETURN_NORMAL);
+
+fail:
+	if (sc.argv != NULL)
+		cmd_free_argv(sc.argc, sc.argv);
+	environ_free(sc.environ);
+	free(wname);
+	return (CMD_RETURN_ERROR);
 }

cmd-rename-session.c

@@ -52,12 +52,12 @@ cmd_rename_session_exec(struct cmd *self, struct cmdq_item *item)
 	char			*newname, *tmp;
 
 	tmp = format_single_from_target(item, args_string(args, 0));
-	newname = clean_name(tmp, "#:.");
-	if (newname == NULL) {
-		cmdq_error(item, "invalid session: %s", tmp);
+	if (!check_name(tmp, SESSION_NAME_FORBID)) {
+		cmdq_error(item, "invalid session name: %s", tmp);
 		free(tmp);
 		return (CMD_RETURN_ERROR);
 	}
+	newname = clean_name(tmp, SESSION_NAME_FORBID);
 	free(tmp);
 	if (strcmp(newname, s->name) == 0) {
 		free(newname);

cmd-rename-window.c

@@ -48,15 +48,21 @@ cmd_rename_window_exec(struct cmd *self, struct cmdq_item *item)
 	struct args		*args = cmd_get_args(self);
 	struct cmd_find_state	*target = cmdq_get_target(item);
 	struct winlink		*wl = target->wl;
-	char			*newname;
+	char			*name;
 
-	newname = format_single_from_target(item, args_string(args, 0));
-	window_set_name(wl->window, newname);
+	name = format_single_from_target(item, args_string(args, 0));
+	if (!check_name(name, WINDOW_NAME_FORBID)) {
+		cmdq_error(item, "invalid window name: %s", name);
+		free(name);
+		return (CMD_RETURN_ERROR);
+	}
+
+	window_set_name(wl->window, name, WINDOW_NAME_FORBID);
 	options_set_number(wl->window->options, "automatic-rename", 0);
+	free(name);
 
 	server_redraw_window_borders(wl->window);
 	server_status_window(wl->window);
-	free(newname);
 
 	return (CMD_RETURN_NORMAL);
 }

cmd-select-pane.c

@@ -217,7 +217,7 @@ cmd_select_pane_exec(struct cmd *self, struct cmdq_item *item)
 
 	if (args_has(args, 'T')) {
 		title = format_single_from_target(item, args_get(args, 'T'));
-		if (screen_set_title(&wp->base, title)) {
+		if (screen_set_title(&wp->base, title, 0)) {
 			notify_pane("pane-title-changed", wp);
 			server_redraw_window_borders(wp->window);
 			server_status_window(wp->window);

cmd-split-window.c

@@ -191,8 +191,9 @@ cmd_split_window_exec(struct cmd *self, struct cmdq_item *item)
 		options_set_number(new_wp->options, "remain-on-exit", 3);
 		if (args_has(args, 'm'))
 			options_set_string(new_wp->options,
-				"remain-on-exit-format",
-				0, "%s", args_get(args, 'm'));
+			    "remain-on-exit-format", 0, "%s",
+			    args_get(args, 'm'));
+		}
 	}
 
 	if (input) {

input.c

@@ -2701,7 +2701,7 @@ input_exit_osc(struct input_ctx *ictx)
 	case 2:
 		if (wp != NULL &&
 		    options_get_number(wp->options, "allow-set-title") &&
-		    screen_set_title(sctx->s, p)) {
+		    screen_set_title(sctx->s, p, 1)) {
 			notify_pane("pane-title-changed", wp);
 			server_redraw_window_borders(wp->window);
 			server_status_window(wp->window);
@@ -2711,7 +2711,7 @@ input_exit_osc(struct input_ctx *ictx)
 		input_osc_4(ictx, p);
 		break;
 	case 7:
-		if (screen_set_path(sctx->s, p) && wp != NULL) {
+		if (wp != NULL && screen_set_path(sctx->s, p, 1)) {
 			server_redraw_window_borders(wp->window);
 			server_status_window(wp->window);
 		}
@@ -2779,7 +2779,7 @@ input_exit_apc(struct input_ctx *ictx)
 
 	if (wp != NULL &&
 	    options_get_number(wp->options, "allow-set-title") &&
-	    screen_set_title(sctx->s, ictx->input_buf)) {
+	    screen_set_title(sctx->s, ictx->input_buf, 1)) {
 		notify_pane("pane-title-changed", wp);
 		server_redraw_window_borders(wp->window);
 		server_status_window(wp->window);
@@ -2822,10 +2822,10 @@ input_exit_rename(struct input_ctx *ictx)
 		if (o != NULL)
 			options_remove_or_default(o, -1, NULL);
 		if (!options_get_number(w->options, "automatic-rename"))
-			window_set_name(w, "");
+			window_set_name(w, "", WINDOW_NAME_FORBID_EXT);
 	} else {
 		options_set_number(w->options, "automatic-rename", 0);
-		window_set_name(w, ictx->input_buf);
+		window_set_name(w, ictx->input_buf, WINDOW_NAME_FORBID_EXT);
 	}
 	server_redraw_window_borders(w);
 	server_status_window(w);

names.c

@@ -95,7 +95,7 @@ check_window_name(struct window *w)
 	name = format_window_name(w);
 	if (strcmp(name, w->name) != 0) {
 		log_debug("@%u new name %s (was %s)", w->id, name, w->name);
-		window_set_name(w, name);
+		window_set_name(w, name, WINDOW_NAME_FORBID_EXT);
 		server_redraw_window_borders(w);
 		server_status_window(w);
 	} else
@@ -166,7 +166,7 @@ parse_window_name(const char *in)
 
 	if (*name == '/')
 		name = basename(name);
-	name = clean_name(name, "#");
+	name = clean_name(name, WINDOW_NAME_FORBID);
 	free(copy);
 	if (name == NULL)
 		return (xstrdup(""));

paste.c

@@ -176,7 +176,6 @@ paste_add(const char *prefix, char *data, size_t size)
 	}
 
 	pb = xmalloc(sizeof *pb);
-
 	pb->name = NULL;
 	do {
 		free(pb->name);
@@ -296,7 +295,6 @@ paste_set(char *data, size_t size, const char *name, char **cause)
 	}
 
 	pb = xmalloc(sizeof *pb);
-
 	pb->name = newname;
 
 	pb->data = data;

popup.c

@@ -435,7 +435,7 @@ popup_make_pane(struct popup_data *pd, enum layout_type type)
 		pd->job = NULL;
 	}
 
-	screen_set_title(&pd->s, new_wp->base.title);
+	screen_set_title(&pd->s, new_wp->base.title, 0);
 	screen_free(&new_wp->base);
 	memcpy(&new_wp->base, &pd->s, sizeof wp->base);
 	screen_resize(&new_wp->base, new_wp->sx, new_wp->sy, 1);

screen.c

@@ -245,11 +245,14 @@ screen_set_cursor_colour(struct screen *s, int colour)
 
 /* Set screen title. */
 int
-screen_set_title(struct screen *s, const char *title)
+screen_set_title(struct screen *s, const char *title, int untrusted)
 {
 	char	*new_title;
 
-	new_title = clean_name(title, "#");
+	if (untrusted)
+		new_title = clean_name(title, "#");
+	else
+		new_title = clean_name(title, "");
 	if (new_title == NULL)
 		return (0);
 	free(s->title);
@@ -259,11 +262,14 @@ screen_set_title(struct screen *s, const char *title)
 
 /* Set screen path. */
 int
-screen_set_path(struct screen *s, const char *path)
+screen_set_path(struct screen *s, const char *path, int untrusted)
 {
 	char	*new_path;
 
-	new_path = clean_name(path, "#");
+	if (untrusted)
+		new_path = clean_name(path, "#");
+	else
+		new_path = clean_name(path, "");
 	if (new_path == NULL)
 		return (0);
 	free(s->path);

session.c

@@ -116,7 +116,6 @@ session_create(const char *prefix, const char *name, const char *cwd,
 	s = xcalloc(1, sizeof *s);
 	s->references = 1;
 	s->flags = 0;
-
 	s->cwd = xstrdup(cwd);
 
 	TAILQ_INIT(&s->lastw);

spawn.c

@@ -74,15 +74,12 @@ spawn_log(const char *from, struct spawn_context *sc)
 struct winlink *
 spawn_window(struct spawn_context *sc, char **cause)
 {
-	struct cmdq_item	*item = sc->item;
-	struct client		*c = cmdq_get_client(item);
 	struct session		*s = sc->s;
 	struct window		*w;
 	struct window_pane	*wp;
 	struct winlink		*wl;
 	int			 idx = sc->idx;
 	u_int			 sx, sy, xpixel, ypixel;
-	char			*name;
 
 	spawn_log(__func__, sc);
 
@@ -180,15 +177,12 @@ spawn_window(struct spawn_context *sc, char **cause)
 	/* Set the name of the new window. */
 	if (~sc->flags & SPAWN_RESPAWN) {
 		free(w->name);
-		if (sc->name != NULL) {
-			name = format_single(item, sc->name, c, s, NULL, NULL);
-			w->name = clean_name(name, "#");
-			free(name);
-			if (w->name == NULL)
-				w->name = xstrdup("");
-			options_set_number(w->options, "automatic-rename", 0);
-		} else
+		if (sc->name == NULL || *sc->name == '\0')
 			w->name = default_window_name(w);
+		else {
+			w->name = xstrdup(sc->name);
+			options_set_number(w->options, "automatic-rename", 0);
+		}
 	}
 
 	/* Switch to the new window if required. */

tmux.c

@@ -298,6 +298,25 @@ clean_name(const char *name, const char* forbid)
 	return (new_name);
 }
 
+/*
+ * Check a name given by a command: reject it if it is empty, not valid UTF-8,
+ * or contains a forbidden character. Other characters that clean_name would
+ * change (for example with utf8_stravis) are allowed and fixed silently.
+ */
+int
+check_name(const char *name, const char *forbid)
+{
+	const char	*cp;
+
+	if (*name == '\0' || !utf8_isvalid(name))
+		return (0);
+	for (cp = name; *cp != '\0'; cp++) {
+		if (strchr(forbid, *cp) != NULL)
+			return (0);
+	}
+	return (1);
+}
+
 const char *
 sig2name(int signo)
 {

tmux.h

@@ -96,6 +96,12 @@ struct winlink;
 #define TMUX_LOCK_CMD "lock -np"
 #endif
 
+/* Forbidden characters in names. */
+#define WINDOW_NAME_FORBID ":."
+#define WINDOW_NAME_FORBID_EXT ":.#"
+#define SESSION_NAME_FORBID ":."
+#define SESSION_NAME_FORBID_EXT ":.#"
+
 /* Minimum layout cell size, NOT including border lines. */
 #define PANE_MINIMUM 1
 
@@ -2404,6 +2410,7 @@ void		 setblocking(int, int);
 char 		*shell_argv0(const char *, int);
 uint64_t	 get_timer(void);
 char		*clean_name(const char *, const char *);
+int		 check_name(const char *, const char *);
 const char	*sig2name(int);
 const char	*find_cwd(void);
 const char	*find_home(void);
@@ -3375,8 +3382,8 @@ void	 screen_reset_hyperlinks(struct screen *);
 void	 screen_set_default_cursor(struct screen *, struct options *);
 void	 screen_set_cursor_style(u_int, enum screen_cursor_style *, int *);
 void	 screen_set_cursor_colour(struct screen *, int);
-int	 screen_set_title(struct screen *, const char *);
-int	 screen_set_path(struct screen *, const char *);
+int	 screen_set_title(struct screen *, const char *, int);
+int	 screen_set_path(struct screen *, const char *, int);
 void	 screen_push_title(struct screen *);
 void	 screen_pop_title(struct screen *);
 void	 screen_set_progress_bar(struct screen *, enum progress_bar_state, int);
@@ -3480,7 +3487,7 @@ void		 window_pane_stack_push(struct window_panes *,
 		     struct window_pane *);
 void		 window_pane_stack_remove(struct window_panes *,
 		     struct window_pane *);
-void		 window_set_name(struct window *, const char *);
+void		 window_set_name(struct window *, const char *, const char *);
 void		 window_add_ref(struct window *, const char *);
 void		 window_remove_ref(struct window *, const char *);
 void		 winlink_clear_flags(struct winlink *);

window.c

@@ -401,11 +401,11 @@ window_remove_ref(struct window *w, const char *from)
 }
 
 void
-window_set_name(struct window *w, const char *new_name)
+window_set_name(struct window *w, const char *new_name, const char *forbid)
 {
 	char	*name;
 
-	name = clean_name(new_name, "#");
+	name = clean_name(new_name, forbid);
 	if (name != NULL) {
 		free(w->name);
 		w->name = name;
@@ -1079,7 +1079,7 @@ window_pane_create(struct window *w, u_int sx, u_int sy, u_int hlimit)
 	style_ranges_init(&wp->border_status_line.ranges);
 
 	if (gethostname(host, sizeof host) == 0)
-		screen_set_title(&wp->base, host);
+		screen_set_title(&wp->base, host, 0);
 
 	return (wp);
 }