ctxline-claude 1.2.1 → 1.2.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/package.json +1 -1
  2. package/statusline.js +3 -1
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "ctxline-claude",
3
- "version": "1.2.1",
3
+ "version": "1.2.2",
4
4
  "description": "A customizable statusline for Claude Code that tracks context usage and session limits",
5
5
  "bin": {
6
6
  "ctxline-claude": "bin/install.js"
package/statusline.js CHANGED
@@ -125,7 +125,9 @@ function getGitBranch(dir) {
125
125
  if (!gitDir) return '';
126
126
  const head = fs.readFileSync(path.join(gitDir, 'HEAD'), 'utf8').trim();
127
127
  const ref = head.match(/^ref:\s*refs\/heads\/(.+)$/);
128
- if (ref) return truncateBranch(ref[1]);
128
+ // Strip control chars: HEAD is read raw (not git-validated), so a hand-crafted file
129
+ // in an untrusted archive could inject terminal escape sequences.
130
+ if (ref) return truncateBranch(ref[1].replace(/[\x00-\x1f\x7f]/g, ''));
129
131
  if (/^[0-9a-f]{7,40}$/i.test(head)) return head.slice(0, 7); // detached HEAD -> short sha
130
132
  return '';
131
133
  } catch (e) {