Insecure: color string injection

[dolmen]

In Sprintf-like functions, colors tags expansion should only happen in format strings, not on the Sprintf-expanded output. This is because the argument values may contain uncontrolled content where the expansion of {{ }} tags could be used to hide malicious strings.

Here is a simple program that is insecure because of cfmt:

package main

import (
	"os"

	"github.com/i582/cfmt/cmd/cfmt"
)

func main() {
	cfmt.EnableColors()
	cfmt.Printf("Hello {{%q}}::blue|bold\n", os.Args[1])
}

$ go run . world                                       
Hello "world"
$ go run . '}}::blue|bold{{Pwned!}}::red|bold|blink{{'
Hello "Pwned!"

Affected functions:

• cfmt.Errorf
• cfmt.Fprintf
• cfmt.Printf
• cfmt.Sprintf