thibault/wezterm
Watch
1
0
Fork
You've already forked wezterm
 0
forked from github/wezterm
Code Pull requests Activity
A GPU-accelerated cross-platform terminal emulator and multiplexer written by @wez and implemented in Rust
8,565 commits 3 branches 114 tags 662 MiB
  • Rust 97.9%
  • Python 1%
  • Shell 0.8%
Find a file
Exact
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Jeff Quast 577474d89e
 Prevent "screen scraping", disable DECRQCRA (#7701) 
* Security fix: prevent screen scraping

Problem
-------

DECRQCRA was added in 6cbb3ba43, for 9702d1cf5 (esctest integration) Sunday, March 17 2019.  Six days later, March 23 2019, although esctest was removed in c93f967bc, DECRQCRA remained enabled by default for all WezTerm releases since.

March 2023, @j4james mentioned WezTerm has this option enabled by default https://github.com/microsoft/terminal/issues/14974, "some people consider it a security risk"

September 2023, https://dgl.cx/2023/09/ansi-terminal-security#cursor-checksum article writes, "using DECRQCRA [..] potential attack here is reading what is displayed on the terminal before a user SSHes to a remote system."

By switching to "alternate screen", it also possible to recover last TUI display, such as contents of the file last opened in an editor.

Example CLI script scrapes screens '0' and '1' of WezTerm, https://github.com/jquast/blessed/blob/master/bin/screen-scrape.py

Solution
--------

Disable https://vt100.net/docs/vt510-rm/DECRQCRA.html by default, may be re-enabled by configuration.

---

Refs: https://github.com/wezterm/wezterm/pull/7701

Co-authored-by: Wez Furlong <wez@wezfurlong.org>
2026-03-31 04:00:28 -07:00
.cargo Update config.toml, fix minor syntax issue 2025-03-06 14:07:56 -08:00
.copr copr: more grubbing around 2023-10-02 16:35:42 -07:00
.github ci: maybe fixup for rpm package split 2025-11-23 15:45:00 +00:00
assets chore: update shell completion descriptions for imgcat --hold option 2025-05-11 09:54:57 -07:00
async_ossl Fix mismatched_lifetime_syntaxes warnings 2025-09-09 07:05:12 -07:00
base91 add cargo deny config, update lru 2024-05-13 08:29:36 -07:00
bidi wezterm-escape-parser: allow building no_std (but with alloc) 2025-05-10 15:07:20 -07:00
bintree Fix mismatched_lifetime_syntaxes warnings 2025-09-09 07:05:12 -07:00
ci Fix COPR virtual package installation on Fedora 43 2026-01-16 05:46:04 +00:00
codec termwiz: fix panic when appending long runs to clusterline 2025-03-08 12:25:06 -07:00
color-types accommodate more no_std builds 2025-05-10 15:07:21 -07:00
config Prevent "screen scraping", disable DECRQCRA (#7701) 2026-03-31 04:00:28 -07:00
deps update harfbuzz to 11.2.1 2025-05-17 06:44:31 -07:00
docs Prevent "screen scraping", disable DECRQCRA (#7701) 2026-03-31 04:00:28 -07:00
env-bootstrap log: add a missing newline 2026-01-08 13:20:11 +00:00
filedescriptor Fix mismatched_lifetime_syntaxes warnings 2025-09-09 07:05:12 -07:00
frecency workspace-ify the deps 2025-02-12 09:43:36 -07:00
lfucache workspace-ify the deps 2025-02-12 09:43:36 -07:00
licenses macOS: bundle and use MetalANGLE to enable Metal rendering 2020-10-17 09:34:01 -07:00
lua-api-crates Fix mismatched_lifetime_syntaxes warnings 2025-09-09 07:05:12 -07:00
luahelper workspace-ify the deps 2025-02-12 09:43:36 -07:00
mux cargo fix 2025-10-05 10:58:00 +01:00
nix flake.lock: Update 2025-12-01 07:57:47 +00:00
procinfo wezterm-escape-parser: allow building no_std (but with alloc) 2025-05-10 15:07:20 -07:00
promise workspace-ify the deps 2025-02-12 09:43:36 -07:00
pty fixup split behavior with default_prog 2025-05-24 11:21:04 -07:00
rangeset workspace-ify the deps 2025-02-12 09:43:36 -07:00
ratelim workspace-ify the deps 2025-02-12 09:43:36 -07:00
strip-ansi-escapes workspace-ify the deps 2025-02-12 09:43:36 -07:00
sync-color-schemes workspace-ify the deps 2025-02-12 09:43:36 -07:00
tabout workspace-ify the deps 2025-02-12 09:43:36 -07:00
term Prevent "screen scraping", disable DECRQCRA (#7701) 2026-03-31 04:00:28 -07:00
termwiz Fix parsing of partial SGR mouse sequences 2026-01-17 15:35:15 +00:00
test-data add colortest script 2025-05-10 08:56:21 -07:00
umask workspace-ify the deps 2025-02-12 09:43:36 -07:00
vtparse vtparse: improve CsiParam Debug impl 2025-05-10 14:53:59 -07:00
wezterm feat: add additional key modifier combinations to exit polling input 2025-05-11 09:54:57 -07:00
wezterm-blob-leases wezterm-blob-leases: Use uuid v4 over v1 2026-01-17 15:44:28 +00:00
wezterm-cell Fix mismatched_lifetime_syntaxes warnings 2025-09-09 07:05:12 -07:00
wezterm-char-props wezterm-char-props: allow building no_std 2025-05-10 15:07:21 -07:00
wezterm-client Fix mismatched_lifetime_syntaxes warnings 2025-09-09 07:05:12 -07:00
wezterm-dynamic cargo fix 2025-10-05 10:58:00 +01:00
wezterm-escape-parser fix: tmux -CC mode not parsing output correctly 2025-05-17 06:06:17 -07:00
wezterm-font fixup some mismatched_lifetime_syntaxes warnings 2025-10-05 10:59:20 +01:00
wezterm-gui fix: memory leak in macOS MetalLayer management 2025-10-14 19:33:09 +01:00
wezterm-gui-subcommands gui-subcommands: remove unused anyhow dep 2025-06-30 06:52:24 +01:00
wezterm-input-types wezterm-escape-parser: allow building no_std (but with alloc) 2025-05-10 15:07:20 -07:00
wezterm-mux-server workspace-ify the deps 2025-02-12 09:43:36 -07:00
wezterm-mux-server-impl workspace-ify the deps 2025-02-12 09:43:36 -07:00
wezterm-open-url workspace-ify the deps 2025-02-12 09:43:36 -07:00
wezterm-ssh cargo fix 2025-10-05 10:58:00 +01:00
wezterm-surface Fix mismatched_lifetime_syntaxes warnings 2025-09-09 07:05:12 -07:00
wezterm-toast-notification Fix macOS notifications to display as toast popups 2026-01-17 15:25:26 +00:00
wezterm-uds Fix mismatched_lifetime_syntaxes warnings 2025-09-09 07:05:12 -07:00
wezterm-version workspace-ify the deps 2025-02-12 09:43:36 -07:00
window Revert "Fix crash on hidpi with wayland (#6508)" 2025-10-14 19:36:43 +01:00
.cirrus.yml ci: cirrus: install deps for testing 2025-02-08 12:26:13 -07:00
.dockerignore ci: switch mkdocs build to docker version 2024-02-03 08:06:55 -07:00
.gitignore refactor: extract wezterm-char-props from termwiz 2025-05-10 15:07:20 -07:00
.gitmodules deps: point to official freetype mirror on github 2025-01-03 09:46:52 -07:00
.mailmap add .mailmap 2022-12-07 12:09:06 -08:00
.rustfmt.toml encoding my preferred import grouping in the rustfmt config 2022-01-17 13:50:51 -07:00
Cargo.lock wezterm-blob-leases: Use uuid v4 over v1 2026-01-17 15:44:28 +00:00
Cargo.toml wezterm-blob-leases: Use uuid v4 over v1 2026-01-17 15:44:28 +00:00
CONTRIBUTING.md Minor typos to CONTRIBUTING.md 2025-03-06 11:40:03 -08:00
deny.toml add cargo deny config, update lru 2024-05-13 08:29:36 -07:00
get-deps Adapt get-deps for NetBSD, and add NetBSD installation instructions. 2025-02-22 05:37:27 -08:00
LICENSE.md Bundle Symbols Nerd Font Mono 2022-01-16 16:04:35 -07:00
Makefile Add font and window geometry settings to "Quick Start" example config (#6412) 2025-05-11 06:06:10 -07:00
mkdocs_macros.py docs: fixup absolute link warning for {{since(nightly)}} 2024-07-15 06:23:31 -07:00
PRIVACY.md s,wez/wezterm,wezterm/wezterm, 2025-02-07 13:08:01 -07:00
README-DISTRO-MAINTAINER.md fonts: remove last resort font 2022-09-15 08:23:58 -07:00
README.md s,wez/wezterm,wezterm/wezterm, 2025-02-07 13:08:01 -07:00

README.md

Wez's Terminal

WezTerm Icon A GPU-accelerated cross-platform terminal emulator and multiplexer written by @wez and implemented in Rust

User facing docs and guide at: https://wezterm.org/

Screenshot

Screenshot of wezterm on macOS, running vim

Installation

https://wezterm.org/installation

Getting help

This is a spare time project, so please bear with me. There are a couple of channels for support:

  • You can use the GitHub issue tracker to see if someone else has a similar issue, or to file a new one.
  • Start or join a thread in our GitHub Discussions; if you have general questions or want to chat with other wezterm users, you're welcome here!
  • There is a Matrix room via Element.io for (potentially!) real time discussions.

The GitHub Discussions and Element/Gitter rooms are better suited for questions than bug reports, but don't be afraid to use whichever you are most comfortable using and we'll work it out.

Supporting the Project

If you use and like WezTerm, please consider sponsoring it: your support helps to cover the fees required to maintain the project and to validate the time spent working on it!

Read more about sponsoring.