Make a string that originates in a response — the ArcGIS error detail, the
non-JSON body snippet, and every text of the catalogue (titles, units, theme
names), which reach stderr in error messages — safe to print:
C0 and C1 controls and DEL are dropped. JSON.parse decodes an escaped ESC (a
backslash-u-001b sequence) into a real ESC byte; printed raw, a hostile or
MITM'd host could drive ANSI/OSC sequences into the terminal (screen clears,
title changes, output spoofing).
Bidi formatting characters (isBidiControl) are dropped, so server text cannot
reorder the visible message.
Every run of whitespace — newlines, tabs, U+2028/U+2029 included — becomes one
space and the ends are trimmed, so the text stays on one line and cannot forge
a log record of its own.
The CLI's JSON output is escaped separately (escapeControlChars in
cli/shared.ts). Written as a char-code filter so no raw control byte appears in
this source.
Make a string that originates in a response — the ArcGIS
errordetail, the non-JSON body snippet, and every text of the catalogue (titles, units, theme names), which reach stderr in error messages — safe to print:JSON.parsedecodes an escaped ESC (a backslash-u-001b sequence) into a real ESC byte; printed raw, a hostile or MITM'd host could drive ANSI/OSC sequences into the terminal (screen clears, title changes, output spoofing).isBidiControl) are dropped, so server text cannot reorder the visible message.The CLI's JSON output is escaped separately (
escapeControlCharsin cli/shared.ts). Written as a char-code filter so no raw control byte appears in this source.