{"version":"2.1.247","anchor":"plugin-marketplace-text-is-sanitised-before-display","canonical_anchor":"plugin-marketplace-text-is-sanitised-before-display","heading":"Plugin marketplace text is sanitised before display","tier":"notice","area":"Plugins","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.247\/e\/plugin-marketplace-text-is-sanitised-before-display","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.247","markdown":"### Plugin marketplace text is sanitised before display\n\nPlugin marketplace names and descriptions are cleaned before display, blocking escape sequences and text-direction spoofing.\n\n**What**\n\nNames, sources, versions and descriptions coming from marketplace metadata are cleaned before being printed in plugin list, detail, update and prune output, and marketplace names containing control or text-direction characters are now rejected outright. This blocks terminal escape sequences and right-to-left spoofing in third-party plugin metadata.\n\n**Details**\n\n- The marketplace-name schema rejects control and bidirectional-formatting characters with the message quoted below.\n- The `plugin update` command path sanitises its messages too.\n\n**Evidence**\n\n`Marketplace name cannot contain control or bidirectional-formatting characters`\n\n- Area: Plugins\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 2\/5"}