It was the case indeed (many many years ago), we discussed at the anuualy curl hackers conference in Nuremberg back in 2017, but the only terminals that we managed to find with the support of this were not younger than 2001.

Anyway, one can write a small filter, to cut any suspicious sequences from the output off, and add some wrapper like that to your bashrc:

curl() { [ -t 1 ] && curl "$@" | sanitize || curl "$@"; }

I see you are using regular formatting for code/shell commands on your comments. Not that that's a problem but just a note you can use one of HN's comments formatting tips[0] for this.

Text after a blank line that is indented by two or more spaces is reproduced verbatim. (This is intended for code.)

[0]: https://news.ycombinator.com/formatdoc

Wow! That's cool. Let's try it

  curl() { [ -t 1 ] && curl "$@" | sanitize || curl "$@"; }

I actually stick to regular formatting on HN because of how terribly code formatting on HN renders on a phone. It doesn't wrap around when you format it as code and I have to scroll horizontally since the width is fixed. But it's probably OK for something like this code snippet.

Yes it works! The difference is minimal though (it was intentionally a one-liner)

> those can include key rebindings; e.g. your Enter key can be rebound to “rm -rf ∗” or “sendfile ∗ [email protected]”.

oh my god. From http://www.termsys.demon.co.uk/vtansi.htm :

> Set Key Definition <ESC>[{key};"{string}"p

> Associates a string of text to a keyboard key. {key} indicates the key by its ASCII value in decimal.

But I can't reproduce it; in my terminal (gnome-terminal), `print('\x1b[97;"echo foo"p')` just shows `cho foo"p`.

So it looks like not all terminals implement it, if any?

No modern terminal implements any of the dangerous escape sequences.

As the other poster mentioned, I'm not aware of any terminal that allows these sequences these days.

This wasn't an uncommon thing back in the 90s with DOS ANSI art. I'm not sure if the original ANSI.SYS included with DOS 5/6 but there was a period of time where people remapped things like "echo y|format c:" using ANSI that only required one to "type somefile.ans/txt". The "fix" was to use an accelerated ANSI driver that dropped key-remapping.

Can you share some information about which terminal applications may be vulnerable to this?

As other commenters have pointed out, apparently there aren’t any modern ones anymore. My information seems to have been out of date.