{"version":"2.1.233","anchor":"plugin-eval-reports-no-longer-pass-through-terminal-escapes","canonical_anchor":"plugin-eval-reports-no-longer-pass-through-terminal-escapes","heading":"Plugin eval reports no longer pass through terminal escapes","tier":"notice","area":"Plugins","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.233\/e\/plugin-eval-reports-no-longer-pass-through-terminal-escapes","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.233","markdown":"### Plugin eval reports no longer pass through terminal escapes\n\nPlugin eval output strips control characters, so a crafted case name cannot mess with your terminal.\n\n**What**\n\nCase names and per-case error lines printed by the plugin eval CLI now have control and format characters, plus line and paragraph separators, replaced with a space, so a crafted case name cannot inject escape sequences into your terminal. The \"case files failed to load\" tally is also suppressed when a JSON report was written.\n\n**Evidence**\n\n`return e.replace(\/[\\p{Cc}\\p{Cf}\\u2028\\u2029]+\/gu, \" \");`\n\n- Area: Plugins\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5"}