You'll notice
Useful3 Signal2
Plugin marketplace names and descriptions are cleaned before display, blocking escape sequences and text-direction spoofing.
What's wrong with this entry?
Anonymous. No account, no email.
What
Names, sources, versions and descriptions coming from marketplace metadata are cleaned before being printed in plugin list, detail, update and prune output, and marketplace names containing control or text-direction characters are now rejected outright. This blocks terminal escape sequences and right-to-left spoofing in third-party plugin metadata.
Details
- The marketplace-name schema rejects control and bidirectional-formatting characters with the message quoted below.
- The
plugin updatecommand path sanitises its messages too.
Evidence
Marketplace name cannot contain control or bidirectional-formatting characters
Strings lifted out of the shipped bundle, so the claim above can be checked against them.