Merge branch 'master' into floating_panes

cmd-break-pane.c

@@ -58,9 +58,14 @@ cmd_break_pane_exec(struct cmd *self, struct cmdq_item *item)
 	struct session		*dst_s = target->s;
 	struct window_pane	*wp = source->wp;
 	struct window		*w = wl->window;
-	char			*name, *cause, *cp;
+	char			*newname, *cause, *cp;
 	int			 idx = target->idx, before;
-	const char		*template;
+	const char		*template, *name = args_get(args, 'n');
+
+	if (name != NULL && !check_name(name, WINDOW_NAME_FORBID)) {
+		cmdq_error(item, "invalid window name: %s", name);
+		return (CMD_RETURN_ERROR);
+	}
 
 	before = args_has(args, 'b');
 	if (args_has(args, 'a') || before) {
@@ -80,8 +85,8 @@ cmd_break_pane_exec(struct cmd *self, struct cmdq_item *item)
 			free(cause);
 			return (CMD_RETURN_ERROR);
 		}
-		if (args_has(args, 'n')) {
-			window_set_name(w, args_get(args, 'n'));
+		if (name != NULL) {
+			window_set_name(w, name, WINDOW_NAME_FORBID);
 			options_set_number(w->options, "automatic-rename", 0);
 		}
 		server_unlink_window(src_s, wl);
@@ -109,12 +114,12 @@ cmd_break_pane_exec(struct cmd *self, struct cmdq_item *item)
 	w->active = wp;
 	w->latest = tc;
 
-	if (!args_has(args, 'n')) {
-		name = default_window_name(w);
-		window_set_name(w, name);
-		free(name);
+	if (name != NULL) {
+		newname = default_window_name(w);
+		window_set_name(w, newname, WINDOW_NAME_FORBID);
+		free(newname);
 	} else {
-		window_set_name(w, args_get(args, 'n'));
+		window_set_name(w, name, 0);
 		options_set_number(w->options, "automatic-rename", 0);
 	}
 

cmd-display-panes.c

@@ -264,7 +264,7 @@ cmd_display_panes_draw(struct client *c, __unused void *data,
 	log_debug("%s: %s @%u", __func__, c->name, w->id);
 
 	TAILQ_FOREACH(wp, &w->panes, entry) {
-		if (window_pane_visible(wp))
+		if (window_pane_is_visible(wp))
 			cmd_display_panes_draw_pane(ctx, wp);
 	}
 }

cmd-new-session.c

@@ -77,8 +77,8 @@ cmd_new_session_exec(struct cmd *self, struct cmdq_item *item)
 	struct termios		 tio, *tiop;
 	struct session_group	*sg = NULL;
 	const char		*errstr, *template, *group, *tmp;
-	char			*cause, *cwd = NULL, *cp, *newname = NULL;
-	char			*name, *prefix = NULL;
+	char			*cause, *cwd = NULL, *cp, *ename;
+	char			*wname = NULL, *sname = NULL, *prefix = NULL;
 	int			 detached, already_attached, is_control = 0;
 	u_int			 sx, sy, dsx, dsy, count = args_count(args);
 	struct spawn_context	 sc = { 0 };
@@ -99,20 +99,29 @@ cmd_new_session_exec(struct cmd *self, struct cmdq_item *item)
 		return (CMD_RETURN_ERROR);
 	}
 
-	tmp = args_get(args, 's');
-	if (tmp != NULL) {
-		name = format_single(item, tmp, c, NULL, NULL, NULL);
-		newname = clean_name(name, "#:.");
-		if (newname == NULL) {
-			cmdq_error(item, "invalid session: %s", name);
-			free(name);
+	if ((tmp = args_get(args, 'n')) != NULL) {
+		ename = format_single(item, tmp, c, NULL, NULL, NULL);
+		if (!check_name(ename, WINDOW_NAME_FORBID)) {
+			cmdq_error(item, "invalid window name: %s", ename);
+			free(ename);
 			return (CMD_RETURN_ERROR);
 		}
-		free(name);
+		wname = clean_name(ename, WINDOW_NAME_FORBID);
+		free(ename);
+	}
+	if ((tmp = args_get(args, 's')) != NULL) {
+		ename = format_single(item, tmp, c, NULL, NULL, NULL);
+		if (!check_name(ename, SESSION_NAME_FORBID)) {
+			cmdq_error(item, "invalid session name: %s", ename);
+			free(ename);
+			goto fail;
+		}
+		sname = clean_name(ename, SESSION_NAME_FORBID);
+		free(ename);
 	}
 	if (args_has(args, 'A')) {
-		if (newname != NULL)
-			as = session_find(newname);
+		if (sname != NULL)
+			as = session_find(sname);
 		else
 			as = target->s;
 		if (as != NULL) {
@@ -120,12 +129,13 @@ cmd_new_session_exec(struct cmd *self, struct cmdq_item *item)
 			    args_has(args, 'D'), args_has(args, 'X'), 0,
 			    args_get(args, 'c'), args_has(args, 'E'),
 			    args_get(args, 'f'));
-			free(newname);
+			free(wname);
+			free(sname);
 			return (retval);
 		}
 	}
-	if (newname != NULL && session_find(newname) != NULL) {
-		cmdq_error(item, "duplicate session: %s", newname);
+	if (sname != NULL && session_find(sname) != NULL) {
+		cmdq_error(item, "duplicate session: %s", sname);
 		goto fail;
 	}
 
@@ -142,12 +152,12 @@ cmd_new_session_exec(struct cmd *self, struct cmdq_item *item)
 		else if (groupwith != NULL)
 			prefix = xstrdup(groupwith->name);
 		else {
-			prefix = clean_name(group, "#:.");
-			if (prefix == NULL) {
-				cmdq_error(item, "invalid session group: %s",
-				    group);
+			if (!check_name(group, SESSION_NAME_FORBID)) {
+				cmdq_error(item,
+				    "invalid session group name: %s", group);
 				goto fail;
 			}
+			prefix = clean_name(group, SESSION_NAME_FORBID);
 		}
 	}
 
@@ -276,7 +286,7 @@ cmd_new_session_exec(struct cmd *self, struct cmdq_item *item)
 		environ_put(env, av->string, 0);
 		av = args_next_value(av);
 	}
-	s = session_create(prefix, newname, cwd, env, oo, tiop);
+	s = session_create(prefix, sname, cwd, env, oo, tiop);
 
 	/* Spawn the initial window. */
 	sc.item = item;
@@ -284,7 +294,7 @@ cmd_new_session_exec(struct cmd *self, struct cmdq_item *item)
 	if (!detached)
 		sc.tc = c;
 
-	sc.name = args_get(args, 'n');
+	sc.name = wname;
 	args_to_vector(args, &sc.argc, &sc.argv);
 
 	sc.idx = -1;
@@ -357,7 +367,8 @@ cmd_new_session_exec(struct cmd *self, struct cmdq_item *item)
 	if (sc.argv != NULL)
 		cmd_free_argv(sc.argc, sc.argv);
 	free(cwd);
-	free(newname);
+	free(wname);
+	free(sname);
 	free(prefix);
 	return (CMD_RETURN_NORMAL);
 
@@ -365,7 +376,8 @@ fail:
 	if (sc.argv != NULL)
 		cmd_free_argv(sc.argc, sc.argv);
 	free(cwd);
-	free(newname);
+	free(wname);
+	free(sname);
 	free(prefix);
 	return (CMD_RETURN_ERROR);
 }

cmd-new-window.c

@@ -61,7 +61,7 @@ cmd_new_window_exec(struct cmd *self, struct cmdq_item *item)
 	struct session		*s = target->s;
 	struct winlink		*wl = target->wl, *new_wl = NULL;
 	int			 idx = target->idx, before;
-	char			*cause = NULL, *cp, *expanded;
+	char			*cause = NULL, *cp, *expanded, *wname;
 	const char		*template, *name;
 	struct cmd_find_state	 fs;
 	struct args_value	*av;
@@ -71,8 +71,18 @@ cmd_new_window_exec(struct cmd *self, struct cmdq_item *item)
 	 * name already exists, select it.
 	 */
 	name = args_get(args, 'n');
-	if (args_has(args, 'S') && name != NULL && target->idx == -1) {
+	if (name != NULL) {
 		expanded = format_single(item, name, c, s, NULL, NULL);
+		if (!check_name(expanded, WINDOW_NAME_FORBID)) {
+			cmdq_error(item, "invalid window name: %s", expanded);
+			free(expanded);
+			return (CMD_RETURN_ERROR);
+		}
+		wname = clean_name(expanded, WINDOW_NAME_FORBID);
+		free(expanded);
+	}
+	if (args_has(args, 'S') && wname != NULL && target->idx == -1) {
+		expanded = format_single(item, wname, c, s, NULL, NULL);
 		RB_FOREACH(wl, winlinks, &s->windows) {
 			if (strcmp(wl->window->name, expanded) != 0)
 				continue;
@@ -80,12 +90,14 @@ cmd_new_window_exec(struct cmd *self, struct cmdq_item *item)
 				new_wl = wl;
 				continue;
 			}
-			cmdq_error(item, "multiple windows named %s", name);
+			cmdq_error(item, "multiple windows named %s", wname);
+			free(wname);
 			free(expanded);
 			return (CMD_RETURN_ERROR);
 		}
 		free(expanded);
 		if (new_wl != NULL) {
+			free(wname);
 			if (args_has(args, 'd'))
 				return (CMD_RETURN_NORMAL);
 			if (session_set_current(s, new_wl) == 0)
@@ -108,7 +120,7 @@ cmd_new_window_exec(struct cmd *self, struct cmdq_item *item)
 	sc.s = s;
 	sc.tc = tc;
 
-	sc.name = args_get(args, 'n');
+	sc.name = wname;
 	args_to_vector(args, &sc.argc, &sc.argv);
 	sc.environ = environ_create();
 
@@ -130,10 +142,7 @@ cmd_new_window_exec(struct cmd *self, struct cmdq_item *item)
 	if ((new_wl = spawn_window(&sc, &cause)) == NULL) {
 		cmdq_error(item, "create window failed: %s", cause);
 		free(cause);
-		if (sc.argv != NULL)
-			cmd_free_argv(sc.argc, sc.argv);
-		environ_free(sc.environ);
-		return (CMD_RETURN_ERROR);
+		goto fail;
 	}
 	if (!args_has(args, 'd') || new_wl == s->curw) {
 		cmd_find_from_winlink(current, new_wl, 0);
@@ -156,5 +165,13 @@ cmd_new_window_exec(struct cmd *self, struct cmdq_item *item)
 	if (sc.argv != NULL)
 		cmd_free_argv(sc.argc, sc.argv);
 	environ_free(sc.environ);
+	free(wname);
 	return (CMD_RETURN_NORMAL);
+
+fail:
+	if (sc.argv != NULL)
+		cmd_free_argv(sc.argc, sc.argv);
+	environ_free(sc.environ);
+	free(wname);
+	return (CMD_RETURN_ERROR);
 }

cmd-rename-session.c

@@ -52,12 +52,12 @@ cmd_rename_session_exec(struct cmd *self, struct cmdq_item *item)
 	char			*newname, *tmp;
 
 	tmp = format_single_from_target(item, args_string(args, 0));
-	newname = clean_name(tmp, "#:.");
-	if (newname == NULL) {
-		cmdq_error(item, "invalid session: %s", tmp);
+	if (!check_name(tmp, SESSION_NAME_FORBID)) {
+		cmdq_error(item, "invalid session name: %s", tmp);
 		free(tmp);
 		return (CMD_RETURN_ERROR);
 	}
+	newname = clean_name(tmp, SESSION_NAME_FORBID);
 	free(tmp);
 	if (strcmp(newname, s->name) == 0) {
 		free(newname);

cmd-rename-window.c

@@ -48,15 +48,21 @@ cmd_rename_window_exec(struct cmd *self, struct cmdq_item *item)
 	struct args		*args = cmd_get_args(self);
 	struct cmd_find_state	*target = cmdq_get_target(item);
 	struct winlink		*wl = target->wl;
-	char			*newname;
+	char			*name;
 
-	newname = format_single_from_target(item, args_string(args, 0));
-	window_set_name(wl->window, newname);
+	name = format_single_from_target(item, args_string(args, 0));
+	if (!check_name(name, WINDOW_NAME_FORBID)) {
+		cmdq_error(item, "invalid window name: %s", name);
+		free(name);
+		return (CMD_RETURN_ERROR);
+	}
+
+	window_set_name(wl->window, name, WINDOW_NAME_FORBID);
 	options_set_number(wl->window->options, "automatic-rename", 0);
+	free(name);
 
 	server_redraw_window_borders(wl->window);
 	server_status_window(wl->window);
-	free(newname);
 
 	return (CMD_RETURN_NORMAL);
 }

cmd-select-pane.c

@@ -135,7 +135,7 @@ cmd_select_pane_exec(struct cmd *self, struct cmdq_item *item)
 	}
 
 	if (args_has(args, 'm') || args_has(args, 'M')) {
-		if (args_has(args, 'm') && !window_pane_visible(wp))
+		if (args_has(args, 'm') && !window_pane_is_visible(wp))
 			return (CMD_RETURN_NORMAL);
 		if (server_check_marked())
 			lastwp = marked_pane.wp;
@@ -217,7 +217,7 @@ cmd_select_pane_exec(struct cmd *self, struct cmdq_item *item)
 
 	if (args_has(args, 'T')) {
 		title = format_single_from_target(item, args_get(args, 'T'));
-		if (screen_set_title(&wp->base, title)) {
+		if (screen_set_title(&wp->base, title, 0)) {
 			notify_pane("pane-title-changed", wp);
 			server_redraw_window_borders(wp->window);
 			server_status_window(wp->window);

cmd-split-window.c

@@ -213,7 +213,7 @@ cmd_split_window_exec(struct cmd *self, struct cmdq_item *item)
 	}
 	if (args_has(args, 'T')) {
 		title = format_single_from_target(item, args_get(args, 'T'));
-		screen_set_title(&new_wp->base, title);
+		screen_set_title(&new_wp->base, title, 0);
 		notify_pane("pane-title-changed", new_wp);
 		free(title);
 	}

input-keys.c

@@ -806,7 +806,7 @@ input_key_mouse(struct window_pane *wp, struct mouse_event *m)
 		return;
 	if (cmd_mouse_at(wp, m, &x, &y, 0) != 0)
 		return;
-	if (!window_pane_visible(wp))
+	if (!window_pane_is_visible(wp))
 		return;
 	if (!input_key_get_mouse(s, m, x, y, &buf, &len))
 		return;

input.c

@@ -2701,7 +2701,7 @@ input_exit_osc(struct input_ctx *ictx)
 	case 2:
 		if (wp != NULL &&
 		    options_get_number(wp->options, "allow-set-title") &&
-		    screen_set_title(sctx->s, p)) {
+		    screen_set_title(sctx->s, p, 1)) {
 			notify_pane("pane-title-changed", wp);
 			server_redraw_window_borders(wp->window);
 			server_status_window(wp->window);
@@ -2711,7 +2711,7 @@ input_exit_osc(struct input_ctx *ictx)
 		input_osc_4(ictx, p);
 		break;
 	case 7:
-		if (screen_set_path(sctx->s, p) && wp != NULL) {
+		if (wp != NULL && screen_set_path(sctx->s, p, 1)) {
 			server_redraw_window_borders(wp->window);
 			server_status_window(wp->window);
 		}
@@ -2779,7 +2779,7 @@ input_exit_apc(struct input_ctx *ictx)
 
 	if (wp != NULL &&
 	    options_get_number(wp->options, "allow-set-title") &&
-	    screen_set_title(sctx->s, ictx->input_buf)) {
+	    screen_set_title(sctx->s, ictx->input_buf, 1)) {
 		notify_pane("pane-title-changed", wp);
 		server_redraw_window_borders(wp->window);
 		server_status_window(wp->window);
@@ -2822,10 +2822,10 @@ input_exit_rename(struct input_ctx *ictx)
 		if (o != NULL)
 			options_remove_or_default(o, -1, NULL);
 		if (!options_get_number(w->options, "automatic-rename"))
-			window_set_name(w, "");
+			window_set_name(w, "", WINDOW_NAME_FORBID_EXT);
 	} else {
 		options_set_number(w->options, "automatic-rename", 0);
-		window_set_name(w, ictx->input_buf);
+		window_set_name(w, ictx->input_buf, WINDOW_NAME_FORBID_EXT);
 	}
 	server_redraw_window_borders(w);
 	server_status_window(w);

names.c

@@ -95,7 +95,7 @@ check_window_name(struct window *w)
 	name = format_window_name(w);
 	if (strcmp(name, w->name) != 0) {
 		log_debug("@%u new name %s (was %s)", w->id, name, w->name);
-		window_set_name(w, name);
+		window_set_name(w, name, WINDOW_NAME_FORBID_EXT);
 		server_redraw_window_borders(w);
 		server_status_window(w);
 	} else
@@ -166,7 +166,7 @@ parse_window_name(const char *in)
 
 	if (*name == '/')
 		name = basename(name);
-	name = clean_name(name, "#");
+	name = clean_name(name, WINDOW_NAME_FORBID);
 	free(copy);
 	if (name == NULL)
 		return (xstrdup(""));

paste.c

@@ -176,7 +176,6 @@ paste_add(const char *prefix, char *data, size_t size)
 	}
 
 	pb = xmalloc(sizeof *pb);
-
 	pb->name = NULL;
 	do {
 		free(pb->name);
@@ -296,7 +295,6 @@ paste_set(char *data, size_t size, const char *name, char **cause)
 	}
 
 	pb = xmalloc(sizeof *pb);
-
 	pb->name = newname;
 
 	pb->data = data;

popup.c

@@ -437,7 +437,7 @@ popup_make_pane(struct popup_data *pd, enum layout_type type)
 		pd->job = NULL;
 	}
 
-	screen_set_title(&pd->s, new_wp->base.title);
+	screen_set_title(&pd->s, new_wp->base.title, 0);
 	screen_free(&new_wp->base);
 	memcpy(&new_wp->base, &pd->s, sizeof wp->base);
 	screen_resize(&new_wp->base, new_wp->sx, new_wp->sy, 1);

regress/check-names.sh

@@ -0,0 +1,140 @@
+#!/bin/sh
+
+# Name validation policy.
+
+PATH=/bin:/usr/bin
+TERM=screen
+
+[ -z "$TEST_TMUX" ] && TEST_TMUX=$(readlink -f ../tmux)
+TMUX="$TEST_TMUX -Ltest -f/dev/null"
+$TMUX kill-server 2>/dev/null
+
+fail()
+{
+	echo "$*"
+	$TMUX kill-server 2>/dev/null
+	exit 1
+}
+
+must_fail()
+{
+	"$@" >/dev/null 2>&1 && fail "unexpected success: $*"
+	return 0
+}
+
+must_equal()
+{
+	got=$1
+	want=$2
+
+	[ "$got" = "$want" ] || fail "got '$got', expected '$want'"
+}
+
+$TMUX new-session -d -x 80 -y 24 || exit 1
+$TMUX set-option -qg allow-set-title on || exit 1
+$TMUX set-option -qg allow-rename on || exit 1
+$TMUX set-option -qg automatic-rename off || exit 1
+
+# Commands reject ':' and '.' for sessions and windows, but allow '#'.
+$TMUX rename-session 'session#ok' || fail "session name with # rejected"
+must_equal "$($TMUX display-message -p '#{session_name}')" 'session#ok'
+must_fail $TMUX rename-session 'session:bad'
+must_fail $TMUX rename-session 'session.bad'
+
+$TMUX rename-window 'window#ok' || fail "window name with # rejected"
+must_equal "$($TMUX display-message -p '#{window_name}')" 'window#ok'
+must_fail $TMUX rename-window 'window:bad'
+must_fail $TMUX rename-window 'window.bad'
+
+$TMUX set-option -q @name 'format#ok' || exit 1
+$TMUX rename-session '#{@name}' || fail "format in session name not expanded"
+must_equal "$($TMUX display-message -p '#{session_name}')" 'format#ok'
+$TMUX rename-window '#{@name}' || fail "format in window name not expanded"
+must_equal "$($TMUX display-message -p '#{window_name}')" 'format#ok'
+must_fail $TMUX rename-session '#{session_name}:bad'
+must_fail $TMUX rename-window '#{window_name}.bad'
+pid=$($TMUX display-message -p '#{pid}')
+
+created=$($TMUX new-session -dP -F '#{session_id}:#{window_id}' \
+	-s 'new-session#ok' -n 'new-window#ok') || \
+	fail "new-session name with # rejected"
+created_session=${created%:*}
+created_window=${created#*:}
+must_equal "$($TMUX display-message -pt "$created_session" '#{session_name}')" \
+	'new-session#ok'
+must_equal "$($TMUX display-message -pt "$created_window" '#{window_name}')" \
+	'new-window#ok'
+$TMUX kill-session -t "$created_session"
+
+must_fail $TMUX new-session -d -s 'new-session:bad'
+must_fail $TMUX new-session -d -s 'new-session.bad'
+must_fail $TMUX new-session -d -n 'new-window:bad'
+must_fail $TMUX new-session -d -n 'new-window.bad'
+
+created_window=$($TMUX new-window -dP -F '#{window_id}' \
+	-n 'created-window#ok') || \
+	fail "new-window name with # rejected"
+must_equal "$($TMUX display-message -pt "$created_window" '#{window_name}')" \
+	'created-window#ok'
+must_fail $TMUX new-window -d -n 'created-window:bad'
+must_fail $TMUX new-window -d -n 'created-window.bad'
+
+created=$($TMUX new-session -dP -F '#{session_id}:#{window_id}' \
+	-s 'new-session-#{pid}' -n 'new-window-#{pid}') || \
+	fail "format in new-session name not expanded"
+created_session=${created%:*}
+created_window=${created#*:}
+must_equal "$($TMUX display-message -pt "$created_session" '#{session_name}')" \
+	"new-session-$pid"
+must_equal "$($TMUX display-message -pt "$created_window" '#{window_name}')" \
+	"new-window-$pid"
+$TMUX kill-session -t "$created_session"
+
+created_window=$($TMUX new-window -dP -F '#{window_id}' -n '#{@name}') || \
+	fail "format in new-window name not expanded"
+must_equal "$($TMUX display-message -pt "$created_window" '#{window_name}')" \
+	'format#ok'
+must_fail $TMUX new-session -d -s 'new-session-#{pid}:bad'
+must_fail $TMUX new-session -d -n 'new-window-#{pid}.bad'
+must_fail $TMUX new-window -d -n '#{window_name}:bad'
+
+# Invalid UTF-8 is never allowed for command names.
+invalid=$(printf '\302')
+must_fail $TMUX rename-session "bad${invalid}name"
+must_fail $TMUX rename-window "bad${invalid}name"
+must_fail $TMUX new-session -d -s "bad${invalid}name"
+must_fail $TMUX new-session -d -n "bad${invalid}name"
+must_fail $TMUX new-window -d -n "bad${invalid}name"
+must_fail $TMUX set-buffer -b "bad${invalid}name" data
+
+# Titles set by commands allow '#', ':' and '.'.
+$TMUX select-pane -T 'title#:.ok' || fail "command title rejected"
+must_equal "$($TMUX display-message -p '#{pane_title}')" 'title#:.ok'
+
+# Buffer names allow '#', ':' and '.'.
+$TMUX set-buffer -b 'buffer#:.ok' data || fail "buffer name rejected"
+must_equal "$($TMUX list-buffers -F '#{buffer_name}')" 'buffer#:.ok'
+
+# Window names from escape sequences reject '#', ':' and '.' by cleaning them.
+$TMUX send-keys "printf '\\033kescape#:.ok\\033\\\\'" Enter || exit 1
+sleep 1
+must_equal "$($TMUX display-message -p '#{window_name}')" 'escape___ok'
+
+# Titles from escape sequences reject only '#'.
+$TMUX send-keys "printf '\\033]2;escape#:.ok\\007'" Enter || exit 1
+sleep 1
+must_equal "$($TMUX display-message -p '#{pane_title}')" 'escape_:.ok'
+
+# Invalid UTF-8 from escape sequences is ignored.
+$TMUX rename-window 'before-invalid' || exit 1
+$TMUX send-keys "printf '\\033kbad\\302name\\033\\\\'" Enter || exit 1
+sleep 1
+must_equal "$($TMUX display-message -p '#{window_name}')" 'before-invalid'
+
+$TMUX select-pane -T 'before-invalid-title' || exit 1
+$TMUX send-keys "printf '\\033]2;bad\\302title\\007'" Enter || exit 1
+sleep 1
+must_equal "$($TMUX display-message -p '#{pane_title}')" 'before-invalid-title'
+
+$TMUX kill-server 2>/dev/null
+exit 0

screen-redraw.c

@@ -316,7 +316,7 @@ screen_redraw_cell_border(struct screen_redraw_ctx *ctx, struct window_pane *wp,
 	 * single z-index.
 	 */
 	TAILQ_FOREACH(wp2, &w->z_index, zentry) {
-		if (!window_pane_visible(wp2) || window_pane_is_floating(wp2))
+		if (!window_pane_is_visible(wp2) || window_pane_is_floating(wp2))
 			continue;
 		n = screen_redraw_cell_border1(ctx, sb_pos, sb_w, wp2, px, py);
 		if (n != -1)
@@ -493,7 +493,7 @@ screen_redraw_check_cell(struct screen_redraw_ctx *ctx, int px, int py,
 	if (!window_pane_is_floating(wp))
 		tiled_only = 1;
 	do { /* loop until back to wp == start */
-		if (!window_pane_visible(wp))
+		if (!window_pane_is_visible(wp))
 			goto next;
 		if (tiled_only && window_pane_is_floating(wp))
 			goto next;
@@ -694,7 +694,7 @@ screen_redraw_draw_pane_status(struct screen_redraw_ctx *ctx)
 	log_debug("%s: %s @%u", __func__, c->name, w->id);
 
 	TAILQ_FOREACH(wp, &w->panes, entry) {
-		if (!window_pane_visible(wp))
+		if (!window_pane_is_visible(wp))
 			continue;
 		s = &wp->status_screen;
 
@@ -868,7 +868,7 @@ screen_redraw_pane(struct client *c, struct window_pane *wp,
 {
 	struct screen_redraw_ctx	ctx;
 
-	if (!window_pane_visible(wp))
+	if (!window_pane_is_visible(wp))
 		return;
 
 	screen_redraw_set_context(c, &ctx);
@@ -1103,7 +1103,7 @@ screen_redraw_draw_panes(struct screen_redraw_ctx *ctx)
 	log_debug("%s: %s @%u", __func__, c->name, w->id);
 
 	TAILQ_FOREACH(wp, &w->panes, entry) {
-		if (window_pane_visible(wp))
+		if (window_pane_is_visible(wp))
 			screen_redraw_draw_pane(ctx, wp);
 	}
 }
@@ -1223,7 +1223,7 @@ screen_redraw_get_visible_ranges(struct window_pane *base_wp, int px,
 			bb = wp->yoff + (int)wp->sy;
 		}
 		if (!found_self ||
-		    !window_pane_visible(wp) ||
+		    !window_pane_is_visible(wp) ||
 		    py < tb ||
 		    py > bb)
 			continue;
@@ -1453,7 +1453,7 @@ screen_redraw_draw_pane_scrollbars(struct screen_redraw_ctx *ctx)
 
 	TAILQ_FOREACH(wp, &w->panes, entry) {
 		if (window_pane_show_scrollbar(wp, ctx->pane_scrollbars) &&
-		    window_pane_visible(wp))
+		    window_pane_is_visible(wp))
 			screen_redraw_draw_pane_scrollbar(ctx, wp);
 	}
 }

screen.c

@@ -245,11 +245,14 @@ screen_set_cursor_colour(struct screen *s, int colour)
 
 /* Set screen title. */
 int
-screen_set_title(struct screen *s, const char *title)
+screen_set_title(struct screen *s, const char *title, int untrusted)
 {
 	char	*new_title;
 
-	new_title = clean_name(title, "#");
+	if (untrusted)
+		new_title = clean_name(title, "#");
+	else
+		new_title = clean_name(title, "");
 	if (new_title == NULL)
 		return (0);
 	free(s->title);
@@ -259,11 +262,14 @@ screen_set_title(struct screen *s, const char *title)
 
 /* Set screen path. */
 int
-screen_set_path(struct screen *s, const char *path)
+screen_set_path(struct screen *s, const char *path, int untrusted)
 {
 	char	*new_path;
 
-	new_path = clean_name(path, "#");
+	if (untrusted)
+		new_path = clean_name(path, "#");
+	else
+		new_path = clean_name(path, "");
 	if (new_path == NULL)
 		return (0);
 	free(s->path);

session.c

@@ -116,7 +116,6 @@ session_create(const char *prefix, const char *name, const char *cwd,
 	s = xcalloc(1, sizeof *s);
 	s->references = 1;
 	s->flags = 0;
-
 	s->cwd = xstrdup(cwd);
 
 	TAILQ_INIT(&s->lastw);

spawn.c

@@ -74,15 +74,12 @@ spawn_log(const char *from, struct spawn_context *sc)
 struct winlink *
 spawn_window(struct spawn_context *sc, char **cause)
 {
-	struct cmdq_item	*item = sc->item;
-	struct client		*c = cmdq_get_client(item);
 	struct session		*s = sc->s;
 	struct window		*w;
 	struct window_pane	*wp;
 	struct winlink		*wl;
 	int			 idx = sc->idx;
 	u_int			 sx, sy, xpixel, ypixel;
-	char			*name;
 
 	spawn_log(__func__, sc);
 
@@ -180,15 +177,12 @@ spawn_window(struct spawn_context *sc, char **cause)
 	/* Set the name of the new window. */
 	if (~sc->flags & SPAWN_RESPAWN) {
 		free(w->name);
-		if (sc->name != NULL) {
-			name = format_single(item, sc->name, c, s, NULL, NULL);
-			w->name = clean_name(name, "#");
-			free(name);
-			if (w->name == NULL)
-				w->name = xstrdup("");
-			options_set_number(w->options, "automatic-rename", 0);
-		} else
+		if (sc->name == NULL || *sc->name == '\0')
 			w->name = default_window_name(w);
+		else {
+			w->name = xstrdup(sc->name);
+			options_set_number(w->options, "automatic-rename", 0);
+		}
 	}
 
 	/* Switch to the new window if required. */

tmux.c

@@ -298,6 +298,25 @@ clean_name(const char *name, const char* forbid)
 	return (new_name);
 }
 
+/*
+ * Check a name given by a command: reject it if it is empty, not valid UTF-8,
+ * or contains a forbidden character. Other characters that clean_name would
+ * change (for example with utf8_stravis) are allowed and fixed silently.
+ */
+int
+check_name(const char *name, const char *forbid)
+{
+	const char	*cp;
+
+	if (*name == '\0' || !utf8_isvalid(name))
+		return (0);
+	for (cp = name; *cp != '\0'; cp++) {
+		if (strchr(forbid, *cp) != NULL)
+			return (0);
+	}
+	return (1);
+}
+
 const char *
 sig2name(int signo)
 {

tmux.h

@@ -96,6 +96,12 @@ struct winlink;
 #define TMUX_LOCK_CMD "lock -np"
 #endif
 
+/* Forbidden characters in names. */
+#define WINDOW_NAME_FORBID ":."
+#define WINDOW_NAME_FORBID_EXT ":.#"
+#define SESSION_NAME_FORBID ":."
+#define SESSION_NAME_FORBID_EXT ":.#"
+
 /* Minimum and maximum layout cell size, NOT including border lines. */
 #define PANE_MINIMUM 1
 #define PANE_MAXIMUM 10000
@@ -2431,6 +2437,7 @@ void		 setblocking(int, int);
 char 		*shell_argv0(const char *, int);
 uint64_t	 get_timer(void);
 char		*clean_name(const char *, const char *);
+int		 check_name(const char *, const char *);
 const char	*sig2name(int);
 const char	*find_cwd(void);
 const char	*find_home(void);
@@ -3402,8 +3409,8 @@ void	 screen_reset_hyperlinks(struct screen *);
 void	 screen_set_default_cursor(struct screen *, struct options *);
 void	 screen_set_cursor_style(u_int, enum screen_cursor_style *, int *);
 void	 screen_set_cursor_colour(struct screen *, int);
-int	 screen_set_title(struct screen *, const char *);
-int	 screen_set_path(struct screen *, const char *);
+int	 screen_set_title(struct screen *, const char *, int);
+int	 screen_set_path(struct screen *, const char *, int);
 void	 screen_push_title(struct screen *);
 void	 screen_pop_title(struct screen *);
 void	 screen_set_progress_bar(struct screen *, enum progress_bar_state, int);
@@ -3496,7 +3503,7 @@ int		 window_pane_key(struct window_pane *, struct client *,
 		     struct mouse_event *);
 void		 window_pane_paste(struct window_pane *, key_code, char *,
 		     size_t);
-int		 window_pane_visible(struct window_pane *);
+int		 window_pane_is_visible(struct window_pane *);
 int		 window_pane_exited(struct window_pane *);
 u_int		 window_pane_search(struct window_pane *, const char *, int,
 		     int);
@@ -3510,7 +3517,7 @@ void		 window_pane_stack_push(struct window_panes *,
 		     struct window_pane *);
 void		 window_pane_stack_remove(struct window_panes *,
 		     struct window_pane *);
-void		 window_set_name(struct window *, const char *);
+void		 window_set_name(struct window *, const char *, const char *);
 void		 window_add_ref(struct window *, const char *);
 void		 window_remove_ref(struct window *, const char *);
 void		 winlink_clear_flags(struct winlink *);

window.c

@@ -409,11 +409,11 @@ window_remove_ref(struct window *w, const char *from)
 }
 
 void
-window_set_name(struct window *w, const char *new_name)
+window_set_name(struct window *w, const char *new_name, const char *forbid)
 {
 	char	*name;
 
-	name = clean_name(new_name, "#");
+	name = clean_name(new_name, forbid);
 	if (name != NULL) {
 		free(w->name);
 		w->name = name;
@@ -654,7 +654,7 @@ window_get_active_at(struct window *w, u_int x, u_int y)
 		 * bottom border.
 		 */
 		TAILQ_FOREACH(wp, &w->z_index, zentry) {
-			if (!window_pane_visible(wp) ||
+			if (!window_pane_is_visible(wp) ||
 			    window_pane_is_floating(wp))
 				continue;
 
@@ -668,7 +668,7 @@ window_get_active_at(struct window *w, u_int x, u_int y)
 	}
 
 	TAILQ_FOREACH(wp, &w->z_index, zentry) {
-		if (!window_pane_visible(wp))
+		if (!window_pane_is_visible(wp))
 			continue;
 		window_pane_full_size_offset(wp, &xoff, &yoff, &sx, &sy);
 		if (!window_pane_is_floating(wp)) {
@@ -1124,7 +1124,7 @@ window_pane_create(struct window *w, u_int sx, u_int sy, u_int hlimit)
 	style_ranges_init(&wp->border_status_line.ranges);
 
 	if (gethostname(host, sizeof host) == 0)
-		screen_set_title(&wp->base, host);
+		screen_set_title(&wp->base, host, 0);
 
 	return (wp);
 }
@@ -1391,7 +1391,7 @@ window_pane_copy_paste(struct window_pane *wp, char *buf, size_t len)
 		    TAILQ_EMPTY(&loop->modes) &&
 		    loop->fd != -1 &&
 		    (~loop->flags & PANE_INPUTOFF) &&
-		    window_pane_visible(loop) &&
+		    window_pane_is_visible(loop) &&
 		    options_get_number(loop->options, "synchronize-panes")) {
 			log_debug("%s: %.*s", __func__, (int)len, buf);
 			bufferevent_write(loop->event, buf, len);
@@ -1409,7 +1409,7 @@ window_pane_copy_key(struct window_pane *wp, key_code key)
 		    TAILQ_EMPTY(&loop->modes) &&
 		    loop->fd != -1 &&
 		    (~loop->flags & PANE_INPUTOFF) &&
-		    window_pane_visible(loop) &&
+		    window_pane_is_visible(loop) &&
 		    options_get_number(loop->options, "synchronize-panes"))
 			input_key_pane(loop, key, NULL);
 	}
@@ -1466,7 +1466,7 @@ window_pane_key(struct window_pane *wp, struct client *c, struct session *s,
 }
 
 int
-window_pane_visible(struct window_pane *wp)
+window_pane_is_visible(struct window_pane *wp)
 {
 	if (window_pane_is_hidden(wp))
 		return (0);