client: mask control bytes in keyboard prompts

The example client prints the keyboard-interactive name, instruction
and prompts through ClientPrintSafe(), which prints a '.' in place of
each control character other than tab and newline, DEL, and each byte
0x80 and up, per RFC 4256 section 3.3 and RFC 4251 section 9.2.

- tests: auth case capturing the printed strings

Issue: F-15534

Author: ejohnstown

examples/client/common.c

@@ -466,6 +466,23 @@ int ClientPublicKeyCheck(const byte* pubKey, word32 pubKeySz, void* ctx)
 }
 
 
+#if defined(WOLFSSH_TERM) && defined(WOLFSSH_KEYBOARD_INTERACTIVE)
+/* Prints a server-supplied string with a '.' in place of each byte that is
+ * a control character other than tab or newline, DEL, or 0x80 and up. */
+static void ClientPrintSafe(const byte* str)
+{
+    byte c;
+
+    for (; *str != 0; str++) {
+        c = *str;
+        if ((c < 0x20 && c != '\t' && c != '\n') || c >= 0x7F)
+            c = '.';
+        putchar(c);
+    }
+}
+#endif
+
+
 int ClientUserAuth(byte authType,
                       WS_UserAuthData* authData,
                       void* ctx)
@@ -577,11 +594,13 @@ int ClientUserAuth(byte authType,
 
         if (authData->sf.keyboard.promptName &&
             authData->sf.keyboard.promptName[0] != '\0') {
-            printf("%s\n", authData->sf.keyboard.promptName);
+            ClientPrintSafe(authData->sf.keyboard.promptName);
+            printf("\n");
         }
         if (authData->sf.keyboard.promptInstruction &&
             authData->sf.keyboard.promptInstruction[0] != '\0') {
-            printf("%s\n", authData->sf.keyboard.promptInstruction);
+            ClientPrintSafe(authData->sf.keyboard.promptInstruction);
+            printf("\n");
         }
 
         /* The server may send another INFO_REQUEST at any time. */
@@ -615,7 +634,7 @@ int ClientUserAuth(byte authType,
          * but test the one this function actually returns. */
         for (entry = 0; ret == WOLFSSH_USERAUTH_SUCCESS && entry < promptCount;
                 entry++) {
-            printf("%s", authData->sf.keyboard.prompts[entry]);
+            ClientPrintSafe(authData->sf.keyboard.prompts[entry]);
             if (!authData->sf.keyboard.promptEcho[entry]) {
                 ClientSetEcho(0);
             }

tests/auth.c

@@ -2809,6 +2809,76 @@ static void test_ClientUserAuth_passwordWiped(void)
     AssertNotNull(freopen("/dev/null", "r", stdin));
 }
 
+/* Server-supplied keyboard-interactive strings reach the terminal with a
+ * '.' for each control byte and each byte 0x80 and up. */
+static void test_ClientUserAuth_keyboardFiltered(void)
+{
+    WS_UserAuthData authData;
+    byte* prompts[1];
+    byte  promptEcho[1];
+    const char* inName = "kb_filter_in.txt";
+    const char* outName = "kb_filter_out.txt";
+    WFILE* f = NULL;
+    WFILE* outFile = NULL;
+    char out[512];
+    size_t outSz;
+    size_t i;
+    int savedStdout;
+    int ret;
+
+    printf("Testing keyboard-interactive strings are filtered\n");
+
+    prompts[0] = (byte*)"p\rq\x9b\x7f: ";
+    promptEcho[0] = 1;
+
+    AssertIntEQ(WFOPEN(NULL, &f, inName, "w"), 0);
+    AssertNotNull(f);
+    AssertIntGT(fprintf(f, "resp\n"), 0);
+    WFCLOSE(NULL, f);
+    AssertNotNull(freopen(inName, "r", stdin));
+    AssertIntEQ(remove(inName), 0);
+
+    KbSetupAuthData(&authData, 1, prompts, promptEcho);
+    authData.sf.keyboard.promptName = (byte*)"a\x1b[2Jb";
+    authData.sf.keyboard.promptInstruction =
+        (byte*)"\xc2\x9b x \xc3\xa9\t\xa0\xe0\x82\x9b.";
+
+    /* Capture through the descriptor alone, leaving the stdout FILE and its
+     * buffering mode as they were. The capture file is unlinked while open
+     * so nothing is left behind if an assert aborts. */
+    AssertIntEQ(WFOPEN(NULL, &outFile, outName, "w+"), 0);
+    AssertNotNull(outFile);
+    AssertIntEQ(remove(outName), 0);
+    fflush(stdout);
+    savedStdout = dup(STDOUT_FILENO);
+    AssertTrue(savedStdout >= 0);
+    AssertTrue(dup2(fileno(outFile), STDOUT_FILENO) >= 0);
+    ret = ClientUserAuth(WOLFSSH_USERAUTH_KEYBOARD, &authData, NULL);
+    fflush(stdout);
+    AssertTrue(dup2(savedStdout, STDOUT_FILENO) >= 0);
+    close(savedStdout);
+
+    AssertIntEQ(ret, WOLFSSH_USERAUTH_SUCCESS);
+    AssertIntEQ(authData.sf.keyboard.responseCount, 1);
+
+    rewind(outFile);
+    outSz = fread(out, 1, sizeof(out) - 1, outFile);
+    WFCLOSE(NULL, outFile);
+    out[outSz] = '\0';
+
+    AssertNotNull(WSTRSTR(out, "a.[2Jb\n"));
+    AssertNotNull(WSTRSTR(out, ".. x ..\t.....\n"));
+    AssertNotNull(WSTRSTR(out, "p.q..: "));
+    for (i = 0; i < outSz; i++) {
+        AssertTrue((byte)out[i] < 0x7F);
+        AssertTrue((byte)out[i] >= 0x20 || out[i] == '\t' ||
+                out[i] == '\n');
+    }
+
+    ClientFreeBuffers(NULL, NULL, NULL);
+    AssertNotNull(freopen("/dev/null", "r", stdin));
+}
+
 #endif /* keyboard-interactive ClientUserAuth tests */
 
 int wolfSSH_AuthTest(int argc, char** argv)
@@ -2901,6 +2971,7 @@ int wolfSSH_AuthTest(int argc, char** argv)
     test_ClientUserAuth_keyboardZeroPrompts();
     test_ClientUserAuth_keyboardRounds();
     test_ClientUserAuth_passwordWiped();
+    test_ClientUserAuth_keyboardFiltered();
 #endif
 
     /* Unknown callback return value must not grant auth (issue 2486) */