<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><br id="lineBreakAtBeginningOfSignature"><div dir="ltr"><p class="MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; -webkit-text-size-adjust: auto;"><br></p></div><div dir="ltr"><blockquote type="cite">11 jan. 2024 kl. 14:44 skrev Marius Spix via Unicode <unicode@corp.unicode.org>:<br><font size="4"><br></font></blockquote></div><blockquote type="cite"><div dir="ltr"><font size="4"></font><div style="font-family: Verdana;"><div style="font-family: Verdana;">
<div style="font-family: Verdana;">
<div><font size="4">Here is an interesting article, how escape sequences can be used to hide malicious context in source code: https://www.infosecmatter.com/terminal-escape-injection/</font></div></div></div></div></div></blockquote><div><font size="4"><br></font></div><span style="font-family: Calibri, sans-serif; -webkit-text-size-adjust: auto;"><font size="4">Thanks for the reference. It is a bit ironic that an article about security is sprinkled with clickbait ads. At least it was for me. But it makes it impossible to include as a reference in any proposal document.</font></span><div><font face="Calibri, sans-serif" size="4"><span style="-webkit-text-size-adjust: auto;"><br></span></font></div><div><span style="font-family: Calibri, sans-serif; -webkit-text-size-adjust: auto;"><font size="4">Yes, there are security concerns. I did include a security aspects section. But I did not mention presentation component editing. I do not plan to propose any changes or additions to presentation component editing controls. IIUC they are sufficient as they are. But I did include that uninterpreted control codes, control sequences, and control strings should be displayed (i.e. not be invisible), and that keyboard input control sequences as well as presentation component editing control sequences must be uninterpreted in a text editor. Regarding ‘cat’ etc., I think they unfortunately are unsalvageable.</font></span></div><div><font face="Calibri, sans-serif" size="4"><span style="-webkit-text-size-adjust: auto;"><br></span></font><blockquote type="cite"><div dir="ltr"><div style="font-family: Verdana;"><div style="font-family: Verdana;"><div style="font-family: Verdana;">
<div><font size="4">This would not happen with human-readable markup like HTML</font></div>
</div>
</div></div>
</div></blockquote><font size="4"><br></font></div><div><font size="4">The problem discussed is <i>unrelated</i> to control sequences vs. tags. But is related to the presence of presentation component (read: display) edit control sequences in ECMA-48, which are not at all covered by my proposal.</font></div><div><font size="4"><br></font></div><div><span style="font-family: Calibri, sans-serif; -webkit-text-size-adjust: auto;"><font size="4">/Kent K</font></span></div><div><span style="font-family: Calibri, sans-serif; font-size: 14.666667px; -webkit-text-size-adjust: auto;"><br></span></div></body></html>