Support for ansi terminal links

[LaKing]

I'm looking for a package that can convert ansi-tagged links to html.

This would produce a link from bash

echo -e '\e]8;;http://example.com\e\\This is a link\e]8;;\e\\'

or in a JS module:

'use strict';

/*
A hyperlink is opened upon encountering an OSC 8 escape sequence with the target URI. The syntax is
OSC 8 ; params ; URI BEL|ST
Following this, all subsequent cells that are painted are hyperlinks to this target. A hyperlink is closed with the same escape sequence, omitting the parameters and the URI but keeping the separators:
OSC 8 ; ; BEL|ST
const ST = '\u001B\\';
 */
const OSC = '\u001B]';
const BEL = '\u0007';
const SEP = ';';

const PARAM_SEP = ':';
const EQ = '=';

module.exports = (text, uri, params) => {
	params = params || {};

	return [
		OSC,
		'8',
		SEP,
		Object.keys(params).map(key => key + EQ + params[key]).join(PARAM_SEP),
		SEP,
		uri,
		BEL,
		text,
		OSC,
		'8',
		SEP,
		SEP,
		BEL
	].join('');
};

Both test cases seem to be skipped by ansi_up. They are neither convertable to text, nor to html. Both seem to work in the terminal.

Could we get these supported?

Thank you very much.

[drudru]

Hi - I am not aware of this new tagging feature. Can you point me at where this is documented?
Which terminals support this?

If this is a new convention, that is great news. We could bring back the linkify code.

[LaKing]

The best documentation found so far is this.

I'm using GNOME on Fedora, and I can confirm both of the above examples work.

JS example to create terminal links:
terminal-link (listed also on the bottom of chalk)
Sample is index.js from
hyperlinker

[drudru]

This is awesome!

I'm happy to add support for this. In progress...

👍

[drudru]

Just an update. This is going to require a bit of work. However, that is ok. Now is a good time to clean up other parts as well.

[LaKing]

Great!

This is my library of choice .) ...
.. let me know if I can help!

[drudru]

Hi - quick update. Made some good progress over the last few days. More soon.

[drudru]

@LaKing - ok - code for testing is up on master. It required a lot of changes, but we were due for that anyways 👍

I will be cleaning it up and revising the Readme tomorrow.
The big difference is that there is only ansi_to_html now.

Lmk if you have any comments on the functionality.

[LaKing]

Works great!

Updated my code, and found no issues so far.

Thank you very much!

The only thing left is an update on the readme, and publishing it to npm. .)

[LaKing]

Oopps, .. It works for the node way of creating links, but the bash way seems to left untouched as text.

[LaKing]

Okay, I found a bug I think.

If the text part has a space, it breaks.

Problematic code "link 12" with a space

^[[34m^[]8;;http://example.com^Glink 12^[]8;;^G^[[0m

Working code "link:12" with no spaces

^[[34m^[]8;;http://example.com^Glink:12^[]8;;^G^[[0m

Both of these work in the terminal, but the problematic html output is

<span>]8;;http://example.com�link 12</span><span>]8;;�</span>

By the way, the alternative bash code for writing links similar way as the node code does (with \a)

## standard
echo -e '\e]8;;http://example.com\aThis is a link\e]8;;\a'
## colored
echo -e '\e[34m\e]8;;http://example.com\aThis is a link\e]8;;\a\e[0m' 

[LaKing]

One more thing.

The URL part seems to rely on the protocol prefix, eg. http or https, thus relative links for example are not parsed, but left out empty. (no html at all)

[alech]

The current implementation is prone to a DOM-based XSS attack. Since the URL parameter allows \x21-\x7e characters and the URL gets inserted into href attribute without filtering, an attacker can close the a tag and add (nearly) arbitrary HTML into the return value of process_hyperlink. I would suggest actually parsing the URL with new URL and then using the href attribute of the result in order to be safe (plus the filtering of the schemes which is already in place and is a good feature could then be made more robust).

PoC:

    var txt = ' \x1b]8;;http://example.com"></a><img/src="foo"onerror=alert(1)><pp\x1b\\.\x1b]8;;\x1b\\ ';

    var ansi_up = new AnsiUp;
    var html = ansi_up.ansi_to_html(txt);
    var cdiv = document.getElementById("console");
    cdiv.innerHTML = html;

[drudru]

@alech - thx, will investigate

[drudru]

@alech - ok, have time this week to work on all these issues. Updates soon.

[drudru]

I'm keeping this issue open for a few more days. Once I push the NPM, then I will close the issue.

[drudru]

Ok - pushed out the npm release. Thanks to all for your help.