Merge branch 'master' into fix/3697-bat-auto-detect-language-from-stdin

src/assets.rs

@@ -158,7 +158,9 @@ impl HighlightingAssets {
         let syntax_match = mapping.get_syntax_for(path);
 
         if let Some(MappingTarget::MapToUnknown) = syntax_match {
-            return Err(Error::UndetectedSyntax(path.to_string_lossy().into()));
+            return Err(Error::UndetectedSyntax(
+                crate::preprocessor::sanitize_for_terminal(&path.to_string_lossy()),
+            ));
         }
 
         if let Some(MappingTarget::MapTo(syntax_name)) = syntax_match {
@@ -175,13 +177,17 @@ impl HighlightingAssets {
         ) {
             (Some(syntax), _) => Ok(syntax),
 
-            (_, Some(MappingTarget::MapExtensionToUnknown)) => {
-                Err(Error::UndetectedSyntax(path.to_string_lossy().into()))
-            }
+            (_, Some(MappingTarget::MapExtensionToUnknown)) => Err(Error::UndetectedSyntax(
+                crate::preprocessor::sanitize_for_terminal(&path.to_string_lossy()),
+            )),
 
             _ => self
                 .get_syntax_for_file_extension(file_name, &mapping.ignored_suffixes)?
-                .ok_or_else(|| Error::UndetectedSyntax(path.to_string_lossy().into())),
+                .ok_or_else(|| {
+                    Error::UndetectedSyntax(crate::preprocessor::sanitize_for_terminal(
+                        &path.to_string_lossy(),
+                    ))
+                }),
         }
     }
 
@@ -341,15 +347,15 @@ impl HighlightingAssets {
         file_name: &OsStr,
         ignored_suffixes: &IgnoredSuffixes,
     ) -> Result<Option<SyntaxReferenceInSet<'_>>> {
-        let mut syntax = self.find_syntax_by_extension(Path::new(file_name).extension())?;
-        if syntax.is_none() {
-            syntax =
-                ignored_suffixes.try_with_stripped_suffix(file_name, |stripped_file_name| {
-                    // Note: recursion
-                    self.get_syntax_for_file_extension(stripped_file_name, ignored_suffixes)
-                })?;
+        let stripped =
+            ignored_suffixes.try_with_stripped_suffix(file_name, |stripped_file_name| {
+                self.get_syntax_for_file_extension(stripped_file_name, ignored_suffixes)
+                    .map(Some)
+            })?;
+        match stripped {
+            Some(syntax) => Ok(syntax),
+            None => self.find_syntax_by_extension(Path::new(file_name).extension()),
         }
-        Ok(syntax)
     }
 
     fn get_first_line_syntax(
@@ -680,6 +686,48 @@ mod tests {
         );
     }
 
+    #[test]
+    fn syntax_detection_ignored_suffix_falls_back_to_first_line() {
+        let mut test = SyntaxDetectionTest::new();
+
+        // By default a `.txt` file uses Plain Text, even with a shebang: the
+        // `.txt` extension wins and first-line detection is not reached.
+        assert_eq!(
+            test.syntax_for_file_with_content("test.txt", "#!/usr/bin/env bash"),
+            "Plain Text"
+        );
+
+        // Once `.txt` is an ignored suffix it is stripped before detection. The
+        // stripped name (`test`) has no extension, so detection falls back to the
+        // first line -- even though `.txt` is itself a registered extension that
+        // would otherwise match as Plain Text. See #2745.
+        test.syntax_mapping.insert_ignored_suffix(".txt");
+        assert_eq!(
+            test.syntax_for_file_with_content("test.txt", "#!/usr/bin/env bash"),
+            "Bourne Again Shell (bash)"
+        );
+        assert_eq!(
+            test.syntax_for_file_with_content("test.txt", "<?php"),
+            "PHP"
+        );
+
+        // A `.txt` file without a recognizable first line keeps no syntax (the
+        // caller renders it as plain text); we must not resurrect the shadowed
+        // `.txt` -> Plain Text match here.
+        assert_eq!(
+            test.syntax_for_file_with_content("notes.txt", "just some prose"),
+            "!no syntax!"
+        );
+
+        // Stripping that exposes a real extension still works: `.dev` is ignored,
+        // and the remaining `.json` extension is detected as usual.
+        test.syntax_mapping.insert_ignored_suffix(".dev");
+        assert_eq!(
+            test.syntax_for_file_with_content("config.json.dev", ""),
+            "JSON"
+        );
+    }
+
     #[test]
     fn syntax_detection_is_case_insensitive() {
         let mut test = SyntaxDetectionTest::new();

src/bin/bat/app.rs

@@ -38,6 +38,15 @@ pub fn env_no_color() -> bool {
     env::var_os("NO_COLOR").is_some_and(|x| !x.is_empty())
 }
 
+fn parse_strip_ansi_value(raw: Option<&str>, flag_name: &str) -> StripAnsiMode {
+    match raw {
+        Some("never") | None => StripAnsiMode::Never,
+        Some("always") => StripAnsiMode::Always,
+        Some("auto") => StripAnsiMode::Auto,
+        _ => unreachable!("other values for {flag_name} are not allowed"),
+    }
+}
+
 enum HelpType {
     Short,
     Long,
@@ -458,16 +467,32 @@ impl App {
                         4
                     },
                 ),
-            strip_ansi: match self
-                .matches
-                .get_one::<String>("strip-ansi")
-                .map(|s| s.as_str())
-            {
-                Some("never") => StripAnsiMode::Never,
-                Some("always") => StripAnsiMode::Always,
-                Some("auto") => StripAnsiMode::Auto,
-                _ => unreachable!("other values for --strip-ansi are not allowed"),
+            strip_ansi: {
+                let sanitize = parse_strip_ansi_value(
+                    self.matches
+                        .get_one::<String>("sanitize")
+                        .map(|s| s.as_str()),
+                    "--sanitize",
+                );
+                let strip_ansi = parse_strip_ansi_value(
+                    self.matches
+                        .get_one::<String>("strip-ansi")
+                        .map(|s| s.as_str()),
+                    "--strip-ansi",
+                );
+                // --sanitize implies --strip-ansi to the same value.
+                if sanitize != StripAnsiMode::Never {
+                    sanitize
+                } else {
+                    strip_ansi
+                }
             },
+            sanitize: parse_strip_ansi_value(
+                self.matches
+                    .get_one::<String>("sanitize")
+                    .map(|s| s.as_str()),
+                "--sanitize",
+            ),
             quiet_empty: self.matches.get_flag("quiet-empty"),
             unbuffered: self.matches.get_flag("unbuffered"),
             theme: theme(self.theme_options()).to_string(),
@@ -590,7 +615,17 @@ impl App {
 
         // Plain if `--plain` is specified at least once.
         if self.matches.get_count("plain") > 0 {
-            return Some(StyleComponents(HashSet::from([StyleComponent::Plain])));
+            let mut components = HashSet::from([StyleComponent::Plain]);
+            // When --diff is active, preserve change markers and snip separators
+            // so that diff output remains visually useful.
+            if self.matches.try_contains_id("diff").unwrap_or_default()
+                && self.matches.get_flag("diff")
+            {
+                #[cfg(feature = "git")]
+                components.insert(StyleComponent::Changes);
+                components.insert(StyleComponent::Snip);
+            }
+            return Some(StyleComponents(components));
         }
 
         // Default behavior.
@@ -635,7 +670,7 @@ impl App {
         Ok(styled_components)
     }
 
-    fn theme_options(&self) -> ThemeOptions {
+    pub(crate) fn theme_options(&self) -> ThemeOptions {
         Self::theme_options_from_matches(&self.matches)
     }
 

src/bin/bat/clap_app.rs

@@ -240,6 +240,7 @@ pub fn build_app(interactive_output: bool) -> Command {
         .arg(
             Arg::new("terminal-width")
                 .long("terminal-width")
+                .overrides_with("terminal-width")
                 .value_name("width")
                 .hide_short_help(true)
                 .allow_hyphen_values(true)
@@ -255,10 +256,13 @@ pub fn build_app(interactive_output: bool) -> Command {
                             })
                             .map_err(|e| e.to_string())
                     })
-                .help(
+                .help("Explicitly set the width of the terminal instead of determining it automatically.")
+                .long_help(
                     "Explicitly set the width of the terminal instead of determining it \
                      automatically. If prefixed with '+' or '-', the value will be treated \
-                     as an offset to the actual terminal width. See also: '--wrap'.",
+                     as an offset to the actual terminal width. This can also be configured \
+                     via the BAT_WIDTH environment variable (e.g. export BAT_WIDTH=\"100\"). \
+                     See also: '--wrap'.",
                 ),
         )
         .arg(
@@ -476,6 +480,24 @@ pub fn build_app(interactive_output: bool) -> Command {
                 language is plain text. Possible values: auto, always, *never*.")
                 .hide_short_help(true)
         )
+        .arg(
+            Arg::new("sanitize")
+                .long("sanitize")
+                .overrides_with("sanitize")
+                .value_name("when")
+                .value_parser(["auto", "always", "never"])
+                .default_value("never")
+                .hide_default_value(true)
+                .help("Sanitize untrusted input for safe display (auto, always, *never*)")
+                .long_help("Specify when to sanitize input bytes for safe terminal display. \
+                Implies --strip-ansi to the same value, and additionally substitutes \
+                terminal-active control bytes (cursor moves, charset switches, beep, etc.) \
+                and Unicode bidi / zero-width formatting characters with the Unicode \
+                replacement character (U+FFFD). Tab, LF, FF, and CRLF pass through. Useful \
+                for displaying untrusted file content (e.g. file-manager preview panes). \
+                Possible values: auto, always, *never*.")
+                .hide_short_help(true)
+        )
         .arg(
             Arg::new("style")
                 .long("style")

src/bin/bat/config.rs

@@ -153,6 +153,7 @@ fn get_args_from_str(content: &str) -> Result<Vec<OsString>, shell_words::ParseE
 pub fn get_args_from_env_vars() -> Vec<OsString> {
     [
         ("--tabs", "BAT_TABS"),
+        ("--terminal-width", "BAT_WIDTH"),
         ("--theme", bat::theme::env::BAT_THEME),
         ("--theme-dark", bat::theme::env::BAT_THEME_DARK),
         ("--theme-light", bat::theme::env::BAT_THEME_LIGHT),

src/bin/bat/main.rs

@@ -17,7 +17,6 @@ use std::path::Path;
 use std::process;
 
 use bat::output::{OutputHandle, OutputType};
-use bat::theme::DetectColorScheme;
 use nu_ansi_term::Color::Green;
 use nu_ansi_term::Style;
 
@@ -39,7 +38,7 @@ use bat::{
     error::*,
     input::Input,
     style::{StyleComponent, StyleComponents},
-    theme::{color_scheme, default_theme, ColorScheme},
+    theme::{default_theme, theme, ColorScheme, ThemeOptions},
     MappingTarget, PagingMode,
 };
 
@@ -153,7 +152,14 @@ pub fn get_languages(config: &Config, cache_dir: &Path) -> Result<String> {
         let comma_separator = ", ";
         let separator = " ";
         // Line-wrapping for the possible file extension overflow.
-        let desired_width = config.term_width - longest - separator.len();
+        // Clamp instead of subtracting: a tiny `--terminal-width` (smaller than the
+        // longest language name) would otherwise underflow `usize` and wrap to a huge
+        // value, silently disabling wrapping (and panicking in debug/overflow-checked
+        // builds). Mirrors the `saturating_sub` fix applied to `print_snip` in #3804.
+        let desired_width = config
+            .term_width
+            .saturating_sub(longest)
+            .saturating_sub(separator.len());
 
         let style = if config.colored_output {
             Green.normal()
@@ -197,7 +203,7 @@ pub fn list_themes(
     cfg: &Config,
     config_dir: &Path,
     cache_dir: &Path,
-    detect_color_scheme: DetectColorScheme,
+    theme_options: ThemeOptions,
 ) -> Result<()> {
     let assets = assets_from_cache_or_binary(cfg.use_custom_assets, cache_dir)?;
     let mut config = cfg.clone();
@@ -206,7 +212,7 @@ pub fn list_themes(
     config.language = Some("Rust");
     config.style_components = StyleComponents(style);
 
-    let default_theme_name = default_theme(color_scheme(detect_color_scheme).unwrap_or_default());
+    let default_theme_name = theme(theme_options).to_string();
     let mut buf = String::new();
     let mut handle = OutputHandle::FmtWrite(&mut buf);
 
@@ -259,7 +265,9 @@ pub fn list_themes(
 fn set_terminal_title_to(new_terminal_title: String) {
     let osc_command_for_setting_terminal_title = "\x1b]0;";
     let osc_end_command = "\x07";
-    print!("{osc_command_for_setting_terminal_title}{new_terminal_title}{osc_end_command}");
+    // Prevent BEL/ESC/C1 bytes in the title from terminating or nesting the OSC.
+    let safe_title = bat::sanitize_for_terminal(&new_terminal_title);
+    print!("{osc_command_for_setting_terminal_title}{safe_title}{osc_end_command}");
     io::stdout().flush().unwrap();
 }
 
@@ -285,7 +293,28 @@ fn run_controller(inputs: Vec<Input>, config: &Config, cache_dir: &Path) -> Resu
 
 #[cfg(feature = "bugreport")]
 fn invoke_bugreport(app: &App, cache_dir: &Path) {
-    use bugreport::{bugreport, collector::*, format::Markdown};
+    use bugreport::{bugreport, collector::*, format::Markdown, report::ReportEntry};
+
+    struct ColorSchemeCollector;
+
+    impl Collector for ColorSchemeCollector {
+        fn description(&self) -> &str {
+            "Detected terminal color scheme"
+        }
+
+        fn collect(
+            &mut self,
+            _: &bugreport::CrateInfo,
+        ) -> std::result::Result<ReportEntry, CollectionError> {
+            let color_scheme = bat::theme::color_scheme(bat::theme::DetectColorScheme::Always);
+            let text = match color_scheme {
+                Some(bat::theme::ColorScheme::Dark) => "dark",
+                Some(bat::theme::ColorScheme::Light) => "light",
+                None => "not detected",
+            };
+            Ok(ReportEntry::Text(text.to_string()))
+        }
+    }
     let pager = bat::config::get_pager_executable(
         app.matches.get_one::<String>("pager").map(|s| s.as_str()),
     )
@@ -307,6 +336,9 @@ fn invoke_bugreport(app: &App, cache_dir: &Path) {
             "BAT_STYLE",
             "BAT_TABS",
             "BAT_THEME",
+            "BAT_WIDTH",
+            bat::theme::env::BAT_THEME_DARK,
+            bat::theme::env::BAT_THEME_LIGHT,
             "COLORTERM",
             "LANG",
             "LC_ALL",
@@ -326,6 +358,7 @@ fn invoke_bugreport(app: &App, cache_dir: &Path) {
             custom_assets_metadata,
         ))
         .info(DirectoryEntries::new("Custom assets", cache_dir))
+        .info(ColorSchemeCollector)
         .info(CompileTimeInformation::default());
 
     #[cfg(feature = "paging")]
@@ -394,14 +427,12 @@ fn run() -> Result<bool> {
             if app.matches.get_flag("list-languages") {
                 let languages: String = get_languages(&config, cache_dir)?;
                 let inputs: Vec<Input> = vec![Input::from_reader(Box::new(languages.as_bytes()))];
-                let plain_config = Config {
-                    style_components: StyleComponents::new(StyleComponent::Plain.components(false)),
-                    paging_mode: PagingMode::QuitIfOneScreen,
-                    ..Default::default()
-                };
+                let mut plain_config = config.clone();
+                plain_config.style_components =
+                    StyleComponents::new(StyleComponent::Plain.components(false));
                 run_controller(inputs, &plain_config, cache_dir)
             } else if app.matches.get_flag("list-themes") {
-                list_themes(&config, config_dir, cache_dir, DetectColorScheme::default())?;
+                list_themes(&config, config_dir, cache_dir, app.theme_options())?;
                 Ok(true)
             } else if app.matches.get_flag("config-file") {
                 println!("{}", config_file().to_string_lossy());

src/config.rs

@@ -111,6 +111,9 @@ pub struct Config<'a> {
     // Whether or not to strip ANSI escape codes from the input
     pub strip_ansi: StripAnsiMode,
 
+    // Substitute terminal-active and spoofing-relevant bytes; implies strip_ansi.
+    pub sanitize: StripAnsiMode,
+
     /// Whether or not to produce no output when input is empty
     pub quiet_empty: bool,
 

src/diff.rs

@@ -1,12 +1,13 @@
 #![cfg(feature = "git")]
 
+use gix::diff::blob::pipeline::{Mode, WorktreeRoots};
+use gix::diff::blob::{Algorithm, HunkIter, ResourceKind};
+use gix::object::tree::EntryKind;
+use path_abs::PathInfo;
 use std::collections::HashMap;
-use std::fs;
 use std::path::Path;
 
-use git2::{DiffOptions, IntoCString, Repository};
-
-#[derive(Copy, Clone, Debug)]
+#[derive(Copy, Clone, Debug, PartialEq, Eq)]
 pub enum LineChange {
     Added,
     RemovedAbove,
@@ -16,68 +17,181 @@ pub enum LineChange {
 
 pub type LineChanges = HashMap<u32, LineChange>;
 
-pub fn get_git_diff(filename: &Path) -> Option<LineChanges> {
-    let repo = Repository::discover(filename).ok()?;
-
-    let repo_path_absolute = fs::canonicalize(repo.workdir()?).ok()?;
-
-    let filepath_absolute = fs::canonicalize(filename).ok()?;
-    let filepath_relative_to_repo = filepath_absolute.strip_prefix(&repo_path_absolute).ok()?;
-
-    let mut diff_options = DiffOptions::new();
-    let pathspec = filepath_relative_to_repo.into_c_string().ok()?;
-    diff_options.pathspec(pathspec);
-    diff_options.context_lines(0);
-
-    let diff = repo
-        .diff_index_to_workdir(None, Some(&mut diff_options))
-        .ok()?;
-
-    let mut line_changes: LineChanges = HashMap::new();
-
-    let mark_section =
-        |line_changes: &mut LineChanges, start: u32, end: i32, change: LineChange| {
-            for line in start..=end as u32 {
-                line_changes.insert(line, change);
+fn collect_changes_from_hunks(hunks: HunkIter) -> Option<LineChanges> {
+    let mut changes: LineChanges = HashMap::new();
+    for hunk in hunks {
+        if hunk.before.is_empty() && !hunk.after.is_empty() {
+            for line in hunk.after {
+                changes.insert(line + 1, LineChange::Added);
             }
-        };
-
-    let _ = diff.foreach(
-        &mut |_, _| true,
-        None,
-        Some(&mut |delta, hunk| {
-            let path = delta.new_file().path().unwrap_or_else(|| Path::new(""));
-
-            if filepath_relative_to_repo != path {
-                return false;
-            }
-
-            let old_lines = hunk.old_lines();
-            let new_start = hunk.new_start();
-            let new_lines = hunk.new_lines();
-            let new_end = (new_start + new_lines) as i32 - 1;
-
-            if old_lines == 0 && new_lines > 0 {
-                mark_section(&mut line_changes, new_start, new_end, LineChange::Added);
-            } else if new_lines == 0 && old_lines > 0 {
-                if new_start == 0 {
-                    mark_section(&mut line_changes, 1, 1, LineChange::RemovedAbove);
-                } else {
-                    mark_section(
-                        &mut line_changes,
-                        new_start,
-                        new_start as i32,
-                        LineChange::RemovedBelow,
-                    );
-                }
+        } else if hunk.after.is_empty() && !hunk.before.is_empty() {
+            if hunk.after.start == 0 {
+                changes.insert(1, LineChange::RemovedAbove);
             } else {
-                mark_section(&mut line_changes, new_start, new_end, LineChange::Modified);
+                changes.insert(hunk.after.start, LineChange::RemovedBelow);
             }
+        } else {
+            for line in hunk.after {
+                changes.insert(line + 1, LineChange::Modified);
+            }
+        }
+    }
 
-            true
-        }),
-        None,
+    Some(changes)
+}
+
+pub fn get_git_diff(filename: &Path) -> Option<LineChanges> {
+    let filepath_absolute = filename.canonicalize().ok()?;
+    let repository = gix::discover(filepath_absolute.parent().ok()?).ok()?;
+    let repo_path_absolute = repository.workdir()?.canonicalize().ok()?;
+    let filepath_relative_to_repo = gix::path::to_unix_separators_on_windows(gix::path::into_bstr(
+        filepath_absolute.strip_prefix(&repo_path_absolute).ok()?,
+    ));
+    let index = repository.index_or_load_from_head_or_empty().ok()?;
+    let index_entry = index.entry_by_path(filepath_relative_to_repo.as_ref())?;
+    let mut cache = repository
+        .diff_resource_cache(
+            Mode::ToGit,
+            WorktreeRoots {
+                old_root: None,
+                new_root: repository.workdir().map(Path::to_path_buf),
+            },
+        )
+        .ok()?;
+    cache
+        .set_resource(
+            index_entry.id,
+            index_entry.mode.to_tree_entry_mode()?.kind(),
+            filepath_relative_to_repo.as_ref(),
+            ResourceKind::OldOrSource,
+            &repository,
+        )
+        .ok()?;
+    cache
+        .set_resource(
+            repository.object_hash().null(),
+            EntryKind::Blob,
+            filepath_relative_to_repo.as_ref(),
+            ResourceKind::NewOrDestination,
+            &repository,
+        )
+        .ok()?;
+    let diff = gix::diff::blob::diff_with_slider_heuristics(
+        Algorithm::Histogram,
+        &cache.prepare_diff().ok()?.interned_input(),
     );
 
-    Some(line_changes)
+    collect_changes_from_hunks(diff.hunks())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{get_git_diff, LineChange};
+    use std::path::{Path, PathBuf};
+    use std::process::Command;
+
+    fn git(repo: &Path, args: &[&str]) {
+        let output = Command::new("git")
+            .args(args)
+            .current_dir(repo)
+            .output()
+            .expect("git command can run");
+        assert!(
+            output.status.success(),
+            "git {args:?} failed\nstdout: {}\nstderr: {}",
+            String::from_utf8_lossy(&output.stdout),
+            String::from_utf8_lossy(&output.stderr)
+        );
+    }
+
+    fn setup_repo() -> tempfile::TempDir {
+        let dir = tempfile::tempdir().expect("can create temporary directory");
+        let repo = dir.path();
+        git(repo, &["init"]);
+        git(repo, &["config", "user.email", "test@test.test"]);
+        git(repo, &["config", "user.name", "Test"]);
+        dir
+    }
+
+    fn create_and_track_file(repo: &tempfile::TempDir, filename: &str) -> PathBuf {
+        let filepath = repo.path().join(filename);
+        std::fs::write(&filepath, "file\n").expect("can write file");
+        git(repo.path(), &["add", filename]);
+        git(repo.path(), &["commit", "-m", "initial"]);
+
+        filepath.to_owned()
+    }
+
+    #[test]
+    fn not_a_git_repository() {
+        let dir = tempfile::tempdir().expect("can create temporary directory");
+        let file = dir.path().join("file.txt");
+        std::fs::write(&file, "line 1\n").expect("can write file");
+
+        assert_eq!(get_git_diff(&file), None);
+    }
+
+    #[test]
+    fn diff_is_calculated_against_index() {
+        let repo = setup_repo();
+        let file = create_and_track_file(&repo, "file.txt");
+
+        std::fs::write(&file, "line 1\nline 2 modified\n").expect("can write file");
+        // Add modified file to index -> should find 0 changes but not none
+        git(repo.path(), &["add", "file.txt"]);
+
+        assert_eq!(get_git_diff(&file).expect("empty map").len(), 0);
+    }
+
+    #[test]
+    fn diff_is_calculated_against_index_2() {
+        let repo = setup_repo();
+        let file = create_and_track_file(&repo, "file.txt");
+
+        std::fs::write(&file, "line 1\nline 2 modified\n").expect("can write file");
+        git(repo.path(), &["add", "file.txt"]);
+        // modify the second line again which should show a single change
+        std::fs::write(&file, "line 1\nline 2 modified again\n").expect("can write file");
+
+        assert_eq!(get_git_diff(&file).expect("one change").len(), 1);
+    }
+
+    #[test]
+    fn diff_is_calculated_correctly() {
+        let repo = setup_repo();
+        create_and_track_file(&repo, "committed.txt");
+        let filename = "committed2.txt";
+        let file = create_and_track_file(&repo, filename);
+
+        std::fs::write(&file, "file\nline 2 added\n").expect("can write file");
+        let mut changes = get_git_diff(&file).expect("multiple changes");
+        assert_eq!(changes.get(&2), Some(&LineChange::Added));
+        git(repo.path(), &["add", filename]);
+
+        std::fs::write(&file, "file\nline 2 modified\n").expect("can write file");
+        changes = get_git_diff(&file).expect("multiple changes");
+        assert_eq!(changes.get(&2), Some(&LineChange::Modified));
+        git(repo.path(), &["add", filename]);
+
+        std::fs::write(&file, "line 2 modified\nline 3 added").expect("can write file");
+        changes = get_git_diff(&file).expect("multiple changes");
+        assert_eq!(changes.get(&1), Some(&LineChange::RemovedAbove));
+        assert_eq!(changes.get(&2), Some(&LineChange::Added));
+    }
+
+    #[test]
+    fn faulty_git_version_does_not_panic() {
+        let repo = setup_repo();
+        let file = create_and_track_file(&repo, "file.txt");
+        std::fs::write(&file, "line 1\nline 2 modified\n").expect("can write file");
+        // changes are detected
+        assert_eq!(get_git_diff(&file).expect("one change").len(), 2);
+        // write invalid repositoryformatversion
+        git(
+            repo.path(),
+            &["config", "core.repositoryformatversion", "one"],
+        );
+        // changes are no longer detected
+        assert_eq!(get_git_diff(&file), None);
+    }
 }

src/input.rs

@@ -207,7 +207,7 @@ impl<'a> Input<'a> {
                     kind: OpenedInputKind::StdIn,
                     description,
                     metadata: self.metadata,
-                    reader: InputReader::new(stdin),
+                    reader: InputReader::try_new(stdin)?,
                 })
             }
 
@@ -216,34 +216,34 @@ impl<'a> Input<'a> {
                 description,
                 metadata: self.metadata,
                 reader: {
-                    let mut file = File::open(&path)
-                        .map_err(|e| format!("'{}': {e}", path.to_string_lossy()))?;
+                    let path_display =
+                        crate::preprocessor::sanitize_for_terminal(&path.to_string_lossy());
+                    let mut file =
+                        File::open(&path).map_err(|e| format!("'{path_display}': {e}"))?;
                     if file.metadata()?.is_dir() {
-                        return Err(format!("'{}' is a directory.", path.to_string_lossy()).into());
+                        return Err(format!("'{path_display}' is a directory.").into());
                     }
 
                     if let Some(stdout) = stdout_identifier {
-                        let input_identifier = Identifier::try_from(file).map_err(|e| {
-                            format!("{}: Error identifying file: {e}", path.to_string_lossy())
-                        })?;
+                        let input_identifier = Identifier::try_from(file)
+                            .map_err(|e| format!("{path_display}: Error identifying file: {e}"))?;
                         if stdout.surely_conflicts_with(&input_identifier) {
                             return Err(format!(
-                                "IO circle detected. The input from '{}' is also an output. Aborting to avoid infinite loop.",
-                                path.to_string_lossy()
+                                "IO circle detected. The input from '{path_display}' is also an output. Aborting to avoid infinite loop.",
                             )
                             .into());
                         }
                         file = input_identifier.into_inner().expect("The file was lost in the clircle::Identifier, this should not have happened...");
                     }
 
-                    InputReader::new(BufReader::new(file))
+                    InputReader::try_new(BufReader::new(file))?
                 },
             }),
             InputKind::CustomReader(reader) => Ok(OpenedInput {
                 description,
                 kind: OpenedInputKind::CustomReader,
                 metadata: self.metadata,
-                reader: InputReader::new(BufReader::new(reader)),
+                reader: InputReader::try_new(BufReader::new(reader))?,
             }),
         }
     }
@@ -257,28 +257,29 @@ pub(crate) struct InputReader<'a> {
 }
 
 impl<'a> InputReader<'a> {
-    pub(crate) fn new<R: BufRead + 'a>(mut reader: R) -> InputReader<'a> {
-        let mut first_line = vec![];
-        reader.read_until(b'\n', &mut first_line).ok();
+    #[cfg(test)]
+    pub(crate) fn new<R: BufRead + 'a>(reader: R) -> InputReader<'a> {
+        Self::try_new(reader).expect("reading the first line failed")
+    }
 
-        let content_type = if first_line.is_empty() {
-            None
-        } else {
-            Some(content_inspector::inspect(&first_line[..]))
-        };
+    pub(crate) fn try_new<R: BufRead + 'a>(mut reader: R) -> io::Result<InputReader<'a>> {
+        let mut first_line = vec![];
+        reader.read_until(b'\n', &mut first_line)?;
+
+        let content_type = inspect_content_type(&first_line);
 
         if content_type == Some(ContentType::UTF_16LE) {
-            read_utf16_line(&mut reader, &mut first_line, 0x00, 0x0A).ok();
+            read_utf16_line(&mut reader, &mut first_line, 0x00, 0x0A)?;
         } else if content_type == Some(ContentType::UTF_16BE) {
-            read_utf16_line(&mut reader, &mut first_line, 0x0A, 0x00).ok();
+            read_utf16_line(&mut reader, &mut first_line, 0x0A, 0x00)?;
         }
 
-        InputReader {
+        Ok(InputReader {
             inner: Box::new(reader),
             first_line,
             content_type,
             unbuffered: false,
-        }
+        })
     }
 
     pub(crate) fn read_line(&mut self, buf: &mut Vec<u8>) -> io::Result<bool> {
@@ -319,6 +320,25 @@ impl<'a> InputReader<'a> {
     }
 }
 
+fn inspect_content_type(first_line: &[u8]) -> Option<ContentType> {
+    if first_line.is_empty() {
+        return None;
+    }
+
+    let content_type = content_inspector::inspect(first_line);
+    if content_type == ContentType::UTF_8 && has_zip_signature(first_line) {
+        Some(ContentType::BINARY)
+    } else {
+        Some(content_type)
+    }
+}
+
+fn has_zip_signature(bytes: &[u8]) -> bool {
+    [b"PK\x03\x04", b"PK\x05\x06", b"PK\x07\x08"]
+        .into_iter()
+        .any(|signature| bytes.starts_with(signature))
+}
+
 fn read_utf16_line<R: BufRead>(
     reader: &mut R,
     buf: &mut Vec<u8>,
@@ -374,6 +394,43 @@ fn basic() {
     assert!(buffer.is_empty());
 }
 
+#[test]
+fn zip_magic_headers_are_treated_as_binary() {
+    for content in [b"PK\x03\x04hello", b"PK\x05\x06hello", b"PK\x07\x08hello"] {
+        let reader = InputReader::new(&content[..]);
+        assert_eq!(Some(ContentType::BINARY), reader.content_type);
+    }
+}
+
+#[test]
+fn non_zip_pk_prefix_is_not_treated_as_binary() {
+    assert_eq!(
+        Some(ContentType::UTF_8),
+        inspect_content_type(b"PK\x03\x03hello")
+    );
+}
+
+#[test]
+fn input_open_returns_initial_read_errors() {
+    struct FailingRead;
+
+    impl Read for FailingRead {
+        fn read(&mut self, _buf: &mut [u8]) -> io::Result<usize> {
+            Err(io::Error::other("initial read failed"))
+        }
+    }
+
+    let input = Input::from_reader(Box::new(FailingRead));
+    let result = input.open(io::empty(), None);
+
+    assert!(result.is_err());
+    assert!(result
+        .err()
+        .unwrap()
+        .to_string()
+        .contains("initial read failed"));
+}
+
 #[test]
 fn utf16le() {
     let content = b"\xFF\xFE\x73\x00\x0A\x00\x64\x00";

src/lessopen.rs

@@ -14,6 +14,53 @@ use crate::{
     input::{Input, InputKind, InputReader, OpenedInput, OpenedInputKind},
 };
 
+/// Wrap `s` in POSIX single quotes. An embedded `'` is encoded as `'\''`
+/// (close, escaped quote, reopen) since `'...'` has no escape character.
+fn shell_quote(s: &str) -> String {
+    if !s.contains('\'') {
+        let mut quoted = String::with_capacity(s.len() + 2);
+        quoted.push('\'');
+        quoted.push_str(s);
+        quoted.push('\'');
+        return quoted;
+    }
+    let mut quoted = String::with_capacity(s.len() + 2);
+    quoted.push('\'');
+    for c in s.chars() {
+        if c == '\'' {
+            quoted.push_str("'\\''");
+        } else {
+            quoted.push(c);
+        }
+    }
+    quoted.push('\'');
+    quoted
+}
+
+/// Substitute the first `%s` in a $LESSOPEN/$LESSCLOSE template with a quoted value.
+fn shell_substitute(template: &str, replacement: &str) -> String {
+    template.replacen("%s", &shell_quote(replacement), 1)
+}
+
+/// Substitute the first two `%s` occurrences positionally in one pass; chaining
+/// `shell_substitute` twice would mis-target if `first` itself contains `%s`.
+fn shell_substitute_two(template: &str, first: &str, second: &str) -> String {
+    let mut out = String::with_capacity(template.len() + first.len() + second.len() + 4);
+    let mut remaining = template;
+    let mut to_substitute = [Some(first), Some(second)];
+    for slot in &mut to_substitute {
+        if let Some(idx) = remaining.find("%s") {
+            out.push_str(&remaining[..idx]);
+            out.push_str(&shell_quote(slot.take().unwrap()));
+            remaining = &remaining[idx + 2..];
+        } else {
+            break;
+        }
+    }
+    out.push_str(remaining);
+    out
+}
+
 /// Preprocess files and/or stdin using $LESSOPEN and $LESSCLOSE
 pub(crate) struct LessOpenPreprocessor {
     lessopen: String,
@@ -87,7 +134,7 @@ impl LessOpenPreprocessor {
                     None => return input.open(stdin, stdout_identifier),
                 };
 
-                let mut lessopen_command = shell(self.lessopen.replacen("%s", path_str, 1));
+                let mut lessopen_command = shell(shell_substitute(&self.lessopen, path_str));
                 lessopen_command.stdout(Stdio::piped());
 
                 let lessopen_output = match lessopen_command.execute_output() {
@@ -122,7 +169,7 @@ impl LessOpenPreprocessor {
                     let mut stdin_buffer = Vec::new();
                     stdin.read_to_end(&mut stdin_buffer)?;
 
-                    let mut lessopen_command = shell(self.lessopen.replacen("%s", "-", 1));
+                    let mut lessopen_command = shell(shell_substitute(&self.lessopen, "-"));
                     lessopen_command.stdout(Stdio::piped());
 
                     let lessopen_output = match lessopen_command.execute_input_output(&stdin_buffer)
@@ -155,7 +202,7 @@ impl LessOpenPreprocessor {
 
         Ok(OpenedInput {
             kind,
-            reader: InputReader::new(BufReader::new(
+            reader: InputReader::try_new(BufReader::new(
                 if matches!(self.kind, LessOpenKind::TempFile) {
                     let lessopen_string = match String::from_utf8(lessopen_stdout) {
                         Ok(string) => string,
@@ -181,7 +228,7 @@ impl LessOpenPreprocessor {
                         lessclose: self
                             .lessclose
                             .as_ref()
-                            .map(|s| s.replacen("%s", &path_str, 1).replacen("%s", &stdout, 1)),
+                            .map(|s| shell_substitute_two(s, &path_str, &stdout)),
                     }
                 } else {
                     Preprocessed {
@@ -189,10 +236,10 @@ impl LessOpenPreprocessor {
                         lessclose: self
                             .lessclose
                             .as_ref()
-                            .map(|s| s.replacen("%s", &path_str, 1).replacen("%s", "-", 1)),
+                            .map(|s| shell_substitute_two(s, &path_str, "-")),
                     }
                 },
-            )),
+            ))?,
             metadata: input.metadata,
             description: input.description,
         })
@@ -261,7 +308,7 @@ impl Drop for Preprocessed {
                 }
             };
 
-            if lessclose_output.status.success() {
+            if !lessclose_output.status.success() {
                 bat_warning!("$LESSCLOSE exited with nonzero exit code",)
             };
         }
@@ -384,4 +431,65 @@ mod tests {
 
         Ok(())
     }
+
+    #[test]
+    fn shell_quote_plain_filename() {
+        assert_eq!(super::shell_quote("file.txt"), "'file.txt'");
+        assert_eq!(super::shell_quote("with space.txt"), "'with space.txt'");
+        assert_eq!(super::shell_quote(""), "''");
+        assert_eq!(super::shell_quote("-"), "'-'");
+    }
+
+    #[test]
+    fn shell_quote_metacharacters_neutralised() {
+        assert_eq!(super::shell_quote("; rm -rf ~ ;"), "'; rm -rf ~ ;'");
+        assert_eq!(super::shell_quote("$(payload)"), "'$(payload)'");
+        assert_eq!(super::shell_quote("`payload`"), "'`payload`'");
+        assert_eq!(super::shell_quote("a|b&c;d"), "'a|b&c;d'");
+        assert_eq!(super::shell_quote("..>/dev/null"), "'..>/dev/null'");
+        assert_eq!(super::shell_quote("\n\t"), "'\n\t'");
+    }
+
+    #[test]
+    fn shell_quote_embedded_single_quote() {
+        assert_eq!(super::shell_quote("it's"), "'it'\\''s'");
+        assert_eq!(super::shell_quote("'"), "''\\'''");
+        assert_eq!(super::shell_quote("a'b'c"), "'a'\\''b'\\''c'");
+    }
+
+    #[test]
+    fn shell_substitute_only_replaces_first_percent_s() {
+        assert_eq!(super::shell_substitute("echo %s", "x"), "echo 'x'");
+        assert_eq!(super::shell_substitute("echo %s %s", "x"), "echo 'x' %s");
+    }
+
+    #[test]
+    fn shell_substitute_protects_against_filename_injection() {
+        let template = "|preproc %s";
+        let attacker_filename = "; rm -rf ~ ;";
+        let result = super::shell_substitute(template, attacker_filename);
+        assert_eq!(result, "|preproc '; rm -rf ~ ;'");
+    }
+
+    #[test]
+    fn shell_substitute_two_replaces_first_two_placeholders() {
+        assert_eq!(
+            super::shell_substitute_two("echo %s and %s done", "a", "b"),
+            "echo 'a' and 'b' done"
+        );
+        // A third %s is left alone.
+        assert_eq!(
+            super::shell_substitute_two("echo %s %s %s", "a", "b"),
+            "echo 'a' 'b' %s"
+        );
+    }
+
+    #[test]
+    fn shell_substitute_two_handles_percent_s_in_first_argument() {
+        // The chained-substitute approach would replace the injected `%s` here.
+        assert_eq!(
+            super::shell_substitute_two("a %s b %s c", "%s", "second"),
+            "a '%s' b 'second' c"
+        );
+    }
 }

src/lib.rs

@@ -54,6 +54,7 @@ mod vscreen;
 pub(crate) mod wrapping;
 
 pub use nonprintable_notation::{BinaryBehavior, NonprintableNotation};
+pub use preprocessor::sanitize_for_terminal;
 pub use preprocessor::StripAnsiMode;
 pub use pretty_printer::{Input, PrettyPrinter, Syntax};
 pub use syntax_mapping::{MappingTarget, SyntaxMapping};

src/output.rs

@@ -23,6 +23,18 @@ pub struct BuiltinPager {
 impl BuiltinPager {
     fn new() -> Self {
         let pager = minus::Pager::new();
+
+        let mut input_register = minus::input::HashedEventRegister::default();
+        input_register.add_key_events(&["home"], |_, _| {
+            minus::input::InputEvent::UpdateUpperMark(0)
+        });
+        input_register.add_key_events(&["end"], |_, _| {
+            minus::input::InputEvent::UpdateUpperMark(usize::MAX)
+        });
+        pager
+            .set_input_classifier(Box::new(input_register))
+            .expect("failed to set input classifier on newly created pager");
+
         let handle = {
             let pager = pager.clone();
             Some(spawn(move || {

src/preprocessor.rs

@@ -139,16 +139,140 @@ pub fn replace_nonprintable(
 /// Strips ANSI escape sequences from the input.
 pub fn strip_ansi(line: &str) -> String {
     let mut buffer = String::with_capacity(line.len());
-
     for seq in EscapeSequenceOffsetsIterator::new(line) {
         if let EscapeSequenceOffsets::Text { .. } = seq {
             buffer.push_str(&line[seq.index_of_start()..seq.index_past_end()]);
         }
     }
-
     buffer
 }
 
+/// Strips ANSI escape sequences and substitutes terminal-active control bytes
+/// and visual-spoofing Unicode codepoints (bidi, zero-width) with U+FFFD.
+pub fn sanitize(line: &str) -> String {
+    let stripped = strip_ansi(line);
+    let mut buffer = String::with_capacity(stripped.len());
+    let bytes = stripped.as_bytes();
+    let mut start = 0;
+    let mut i = 0;
+    // Skip directly to the next trigger byte instead of testing each one.
+    while let Some(off) = bytes[i..].iter().position(|&b| is_sanitize_trigger(b)) {
+        i += off;
+        let len = sanitize_at(bytes, i, &stripped, &mut buffer, &mut start);
+        i += len;
+    }
+    buffer.push_str(&stripped[start..]);
+    buffer
+}
+
+#[inline]
+fn is_sanitize_trigger(b: u8) -> bool {
+    // C0 controls minus \t \n \f; DEL; UTF-8 leads with dangerous codepoints.
+    matches!(b, 0x00..=0x08 | 0x0B | 0x0D..=0x1F | 0x7F | 0xC2 | 0xD8 | 0xE2 | 0xEF)
+}
+
+/// Substitutes the byte/sequence at `bytes[i]` (or passes it through on
+/// false-alarm trigger), flushing the prefix from `start`. Returns bytes consumed.
+fn sanitize_at(
+    bytes: &[u8],
+    i: usize,
+    full: &str,
+    buffer: &mut String,
+    start: &mut usize,
+) -> usize {
+    buffer.push_str(&full[*start..i]);
+    let consumed = match bytes[i] {
+        b'\r' if bytes.get(i + 1) == Some(&b'\n') => {
+            buffer.push_str("\r\n");
+            2
+        }
+        // 0xC2 leads U+0080..U+00FF; filter the C1 range.
+        0xC2 if matches!(bytes.get(i + 1), Some(0x80..=0x9F)) => {
+            buffer.push('\u{FFFD}');
+            2
+        }
+        0xE2 if is_dangerous_e2(bytes, i) => {
+            buffer.push('\u{FFFD}');
+            3
+        }
+        // 0xEF 0xBB 0xBF = U+FEFF (BOM / zero-width no-break space).
+        0xEF if bytes.get(i + 1) == Some(&0xBB) && bytes.get(i + 2) == Some(&0xBF) => {
+            buffer.push('\u{FFFD}');
+            3
+        }
+        // 0xD8 0x9C = U+061C (Arabic letter mark, a bidi control). The rest of
+        // the 0xD8 block is ordinary Arabic text.
+        0xD8 if bytes.get(i + 1) == Some(&0x9C) => {
+            buffer.push('\u{FFFD}');
+            2
+        }
+        // False-alarm trigger: pass the full UTF-8 sequence through.
+        lead @ (0xC2 | 0xD8 | 0xE2 | 0xEF) => {
+            let n = utf8_len_from_lead(lead);
+            buffer.push_str(&full[i..i + n]);
+            n
+        }
+        _ => {
+            buffer.push('\u{FFFD}');
+            1
+        }
+    };
+    *start = i + consumed;
+    consumed
+}
+
+#[inline]
+fn is_dangerous_e2(bytes: &[u8], i: usize) -> bool {
+    // U+200B..D (zero-width), U+200E..F (LRM/RLM), U+202A..E (bidi embedding
+    // and override), U+2066..9 (bidi isolates).
+    matches!(
+        (bytes.get(i + 1), bytes.get(i + 2)),
+        (Some(0x80), Some(0x8B..=0x8F | 0xAA..=0xAE)) | (Some(0x81), Some(0xA6..=0xA9))
+    )
+}
+
+#[inline]
+fn utf8_len_from_lead(lead: u8) -> usize {
+    if lead < 0x80 {
+        1
+    } else if lead < 0xE0 {
+        2
+    } else if lead < 0xF0 {
+        3
+    } else {
+        4
+    }
+}
+
+/// Escape C0, DEL, and C1 control characters so a string from an untrusted
+/// filename or path can be safely written to the terminal.
+pub fn sanitize_for_terminal(input: &str) -> String {
+    if !input
+        .chars()
+        .any(|c| matches!(c, '\x00'..='\x08' | '\x0A'..='\x1F' | '\x7F'..='\u{9F}'))
+    {
+        return input.to_owned();
+    }
+
+    let mut out = String::with_capacity(input.len() + 8);
+    for c in input.chars() {
+        match c {
+            '\t' => out.push('\t'),
+            '\x00'..='\x1F' => {
+                out.push('^');
+                out.push(char::from_u32(0x40 + c as u32).unwrap_or('?'));
+            }
+            '\x7F' => out.push_str("^?"),
+            '\u{80}'..='\u{9F}' => {
+                use std::fmt::Write as _;
+                let _ = write!(out, "\\u{{{:x}}}", c as u32);
+            }
+            other => out.push(other),
+        }
+    }
+    out
+}
+
 /// Strips overstrike sequences (backspace formatting) from input.
 ///
 /// Overstrike formatting is used by man pages and some help output:
@@ -241,6 +365,113 @@ fn test_strip_ansi() {
     );
 }
 
+#[test]
+fn test_strip_ansi_8bit_c1_introducers() {
+    assert_eq!(strip_ansi("a\u{9B}31mRED\u{9B}0mb"), "aREDb");
+    assert_eq!(strip_ansi("a\x1bP1;0|payload\x1b\\b"), "ab");
+    assert_eq!(strip_ansi("a\u{90}body\u{9C}b"), "ab");
+}
+
+#[test]
+fn test_strip_ansi_single_char_esc() {
+    // strip_ansi must consume both bytes of single-byte ESC sequences (RIS, DECSC, keypad, VT52).
+    assert_eq!(strip_ansi("a\x1bcb"), "ab");
+    assert_eq!(strip_ansi("a\x1b7b\x1b8c"), "abc");
+    assert_eq!(strip_ansi("a\x1b=b\x1b>c"), "abc");
+    assert_eq!(strip_ansi("a\x1bZb"), "ab");
+}
+
+#[test]
+fn test_strip_ansi_preserves_control_bytes() {
+    // strip_ansi removes only ANSI escape sequences; control bytes pass through.
+    assert_eq!(strip_ansi("safe\rEVIL"), "safe\rEVIL");
+    assert_eq!(strip_ansi("a\x08b\x07c\x0E\x0Fd"), "a\x08b\x07c\x0E\x0Fd");
+}
+
+#[test]
+fn test_sanitize_substitutes_dangerous_bytes() {
+    let r = '\u{FFFD}';
+    assert_eq!(sanitize("safe\rEVIL"), format!("safe{r}EVIL"));
+    assert_eq!(sanitize("a\x08b"), format!("a{r}b"));
+    assert_eq!(sanitize("a\x07b"), format!("a{r}b"));
+    assert_eq!(sanitize("a\x0Bb"), format!("a{r}b"));
+    assert_eq!(sanitize("a\x0Eb\x0Fc"), format!("a{r}b{r}c"));
+    assert_eq!(sanitize("a\u{8D}b"), format!("a{r}b"));
+    assert_eq!(sanitize("a\u{85}b"), format!("a{r}b"));
+    assert_eq!(sanitize("trailing\r"), format!("trailing{r}"));
+    assert_eq!(sanitize("a\x7Fb"), format!("a{r}b"));
+}
+
+#[test]
+fn test_sanitize_substitutes_bidi_and_zero_width() {
+    let r = '\u{FFFD}';
+    // Trojan-Source bidi formatting: U+202A..U+202E
+    assert_eq!(sanitize("a\u{202A}b"), format!("a{r}b"));
+    assert_eq!(sanitize("a\u{202E}b"), format!("a{r}b"));
+    // Bidi isolates: U+2066..U+2069
+    assert_eq!(sanitize("a\u{2066}b"), format!("a{r}b"));
+    assert_eq!(sanitize("a\u{2069}b"), format!("a{r}b"));
+    // Zero-width: U+200B..U+200D
+    assert_eq!(sanitize("a\u{200B}b"), format!("a{r}b"));
+    assert_eq!(sanitize("a\u{200D}b"), format!("a{r}b"));
+    // BOM in middle of file: U+FEFF
+    assert_eq!(sanitize("a\u{FEFF}b"), format!("a{r}b"));
+}
+
+#[test]
+fn test_sanitize_substitutes_every_bidi_control() {
+    // Unicode Bidi_Control is exactly these 12 codepoints. Covering only some
+    // of them leaves a reordering attack available through the rest.
+    let r = '\u{FFFD}';
+    for c in [
+        '\u{061C}', '\u{200E}', '\u{200F}', '\u{202A}', '\u{202B}', '\u{202C}', '\u{202D}',
+        '\u{202E}', '\u{2066}', '\u{2067}', '\u{2068}', '\u{2069}',
+    ] {
+        assert_eq!(
+            sanitize(&format!("a{c}b")),
+            format!("a{r}b"),
+            "U+{:04X} was not substituted",
+            c as u32
+        );
+    }
+}
+
+#[test]
+fn test_sanitize_preserves_arabic_sharing_the_alm_lead_byte() {
+    // U+061C is reached via lead byte 0xD8, which also leads ordinary Arabic.
+    assert_eq!(
+        sanitize("\u{0600}\u{061F}\u{06FF}"),
+        "\u{0600}\u{061F}\u{06FF}"
+    );
+    assert_eq!(sanitize("مرحبا بالعالم"), "مرحبا بالعالم");
+}
+
+#[test]
+fn test_sanitize_preserves_legitimate_bytes() {
+    assert_eq!(sanitize("crlf\r\nline\r\n"), "crlf\r\nline\r\n");
+    assert_eq!(sanitize("a\tb\nc"), "a\tb\nc");
+    assert_eq!(sanitize("plain ascii"), "plain ascii");
+    assert_eq!(sanitize("üñíçödé"), "üñíçödé");
+    // FF (U+000C) passes through; section separator in C source / Emacs Lisp.
+    assert_eq!(sanitize("section1\x0Csection2"), "section1\x0Csection2");
+    // Common Unicode that shares a UTF-8 lead byte with dangerous codepoints
+    // must pass through unchanged.
+    assert_eq!(sanitize("snowman ☃ moon ☾"), "snowman ☃ moon ☾");
+    assert_eq!(sanitize("emoji 🎉 ☃"), "emoji 🎉 ☃");
+    assert_eq!(sanitize("0xC2 lead: ÿ ñ ç"), "0xC2 lead: ÿ ñ ç");
+    assert_eq!(sanitize("CJK 漢字 emoji 🦀"), "CJK 漢字 emoji 🦀");
+}
+
+#[test]
+fn test_sanitize_strips_ansi() {
+    let r = '\u{FFFD}';
+    // sanitize is a strict superset of strip_ansi.
+    assert_eq!(sanitize("a\x1B[31mb\x1B[0mc"), "abc");
+    assert_eq!(sanitize("a\u{9B}31mb\u{9B}0mc"), "abc");
+    // ANSI then dangerous byte: ANSI gone, byte substituted.
+    assert_eq!(sanitize("\x1B[31mhello\rEVIL"), format!("hello{r}EVIL"));
+}
+
 #[test]
 fn test_strip_overstrike() {
     // Bold: X\x08X (same char repeated)
@@ -261,3 +492,40 @@ fn test_strip_overstrike() {
     // Unicode with overstrike
     assert_eq!(strip_overstrike("ä\x08äöü", 2), "äöü");
 }
+
+#[test]
+fn test_sanitize_for_terminal_passthrough() {
+    assert_eq!(sanitize_for_terminal(""), "");
+    assert_eq!(sanitize_for_terminal("hello.txt"), "hello.txt");
+    assert_eq!(sanitize_for_terminal("résumé.pdf"), "résumé.pdf");
+    assert_eq!(sanitize_for_terminal("日本語.md"), "日本語.md");
+    assert_eq!(
+        sanitize_for_terminal("path/with spaces/file.log"),
+        "path/with spaces/file.log"
+    );
+    assert_eq!(sanitize_for_terminal("a\tb"), "a\tb");
+}
+
+#[test]
+fn test_sanitize_for_terminal_c0_controls() {
+    assert_eq!(
+        sanitize_for_terminal("\x1b[31mINJECTED\x1b[0m.txt"),
+        "^[[31mINJECTED^[[0m.txt"
+    );
+    assert_eq!(sanitize_for_terminal("bad\x07rest"), "bad^Grest");
+    assert_eq!(sanitize_for_terminal("\x00\x08\n\r\x7F"), "^@^H^J^M^?");
+    assert_eq!(sanitize_for_terminal("\u{9b}31m"), "\\u{9b}31m");
+    assert_eq!(
+        sanitize_for_terminal("\u{9d}0;pwned\x07"),
+        "\\u{9d}0;pwned^G"
+    );
+}
+
+#[test]
+fn test_sanitize_for_terminal_idempotent_on_sanitized() {
+    let dirty = "\x1b]0;pwned\x07file.txt";
+    let clean = sanitize_for_terminal(dirty);
+    assert_eq!(sanitize_for_terminal(&clean), clean);
+    assert!(!clean.contains('\x1b'));
+    assert!(!clean.contains('\x07'));
+}

src/pretty_printer.rs

@@ -192,6 +192,15 @@ impl<'a> PrettyPrinter<'a> {
         self
     }
 
+    /// Whether to sanitize untrusted input for safe display (default: never)
+    ///
+    /// Strips ANSI escape sequences and additionally substitutes terminal-active
+    /// control bytes and bidi / zero-width codepoints with U+FFFD.
+    pub fn sanitize(&mut self, mode: StripAnsiMode) -> &mut Self {
+        self.config.sanitize = mode;
+        self
+    }
+
     /// Text wrapping mode (default: do not wrap)
     pub fn wrapping_mode(&mut self, mode: WrappingMode) -> &mut Self {
         self.config.wrapping_mode = mode;

src/printer.rs

@@ -29,7 +29,10 @@ use crate::error::*;
 use crate::input::OpenedInput;
 use crate::line_range::{MaxBufferedLineNumber, RangeCheckResult};
 use crate::output::OutputHandle;
-use crate::preprocessor::{expand_tabs, replace_nonprintable, strip_ansi, strip_overstrike};
+use crate::preprocessor::{
+    expand_tabs, replace_nonprintable, sanitize, sanitize_for_terminal, strip_ansi,
+    strip_overstrike,
+};
 use crate::style::StyleComponent;
 use crate::terminal::{as_terminal_escaped, to_ansi_color};
 use crate::vscreen::{AnsiStyle, EscapeSequence, EscapeSequenceIterator};
@@ -37,6 +40,16 @@ use crate::wrapping::WrappingMode;
 use crate::BinaryBehavior;
 use crate::StripAnsiMode;
 
+// Return the displayed width of a character.
+//
+// Control characters (0x00..=0x1F and 0x7F) are rendered by the terminal
+// in caret notation (e.g. ^@, ^A, ..., ^?), which occupies two columns.
+// UnicodeWidthChar::width() returns None for these, so we map them to 2
+// here instead of the previous default of 0.
+fn char_width(c: char) -> usize {
+    c.width().unwrap_or(if c.is_control() { 2 } else { 0 })
+}
+
 const ANSI_UNDERLINE_ENABLE: EscapeSequence = EscapeSequence::CSI {
     raw_sequence: "\x1B[4m",
     parameters: "4",
@@ -198,6 +211,7 @@ pub(crate) struct InteractivePrinter<'a> {
     background_color_highlight: Option<Color>,
     consecutive_empty_lines: usize,
     strip_ansi: bool,
+    sanitize: bool,
     strip_overstrike: bool,
 }
 
@@ -261,7 +275,9 @@ impl<'a> InteractivePrinter<'a> {
 
         let needs_to_match_syntax = (!is_printing_binary
             || matches!(config.binary, BinaryBehavior::AsText))
-            && (config.colored_output || config.strip_ansi == StripAnsiMode::Auto);
+            && (config.colored_output
+                || config.strip_ansi == StripAnsiMode::Auto
+                || config.sanitize == StripAnsiMode::Auto);
 
         let (is_plain_text, strip_overstrike, highlighter_from_set) = if needs_to_match_syntax {
             // Determine the type of syntax for highlighting
@@ -307,6 +323,14 @@ impl<'a> InteractivePrinter<'a> {
             _ => false,
         };
 
+        let sanitize = match config.sanitize {
+            _ if config.show_nonprintable => false,
+            StripAnsiMode::Always => true,
+            StripAnsiMode::Auto if is_plain_text => false,
+            StripAnsiMode::Auto => true,
+            _ => false,
+        };
+
         Ok(InteractivePrinter {
             panel_width,
             colors,
@@ -320,6 +344,7 @@ impl<'a> InteractivePrinter<'a> {
             background_color_highlight,
             consecutive_empty_lines: 0,
             strip_ansi,
+            sanitize,
             strip_overstrike,
         })
     }
@@ -479,7 +504,7 @@ impl Printer for InteractivePrinter<'_> {
                      (but will be present if the output of 'bat' is piped). You can use 'bat -A' \
                      to show the binary file contents.",
                     Yellow.paint("[bat warning]"),
-                    input.description.summary(),
+                    sanitize_for_terminal(&input.description.summary()),
                 )?;
             } else if self.config.style_components.grid() {
                 self.print_horizontal_line(handle, '┬')?;
@@ -533,9 +558,11 @@ impl Printer for InteractivePrinter<'_> {
                         "{}{}{mode}",
                         description
                             .kind()
-                            .map(|kind| format!("{kind}: "))
+                            .map(|kind| format!("{}: ", sanitize_for_terminal(kind)))
                             .unwrap_or_else(|| "".into()),
-                        self.colors.header_value.paint(description.title()),
+                        self.colors
+                            .header_value
+                            .paint(sanitize_for_terminal(description.title())),
                     );
                     self.print_header_multiline_component(handle, &header_filename)
                 }
@@ -589,11 +616,23 @@ impl Printer for InteractivePrinter<'_> {
         let title = "8<";
         let title_count = title.chars().count();
 
-        let snip_left = "─ ".repeat((self.config.term_width - panel_count - (title_count / 2)) / 4);
+        let snip_left = "─ ".repeat(
+            self.config
+                .term_width
+                .saturating_sub(panel_count)
+                .saturating_sub(title_count / 2)
+                / 4,
+        );
         let snip_left_count = snip_left.chars().count(); // Can't use .len() with Unicode.
 
-        let snip_right =
-            " ─".repeat((self.config.term_width - panel_count - snip_left_count - title_count) / 2);
+        let snip_right = " ─".repeat(
+            self.config
+                .term_width
+                .saturating_sub(panel_count)
+                .saturating_sub(snip_left_count)
+                .saturating_sub(title_count)
+                / 2,
+        );
 
         writeln!(
             handle,
@@ -649,8 +688,10 @@ impl Printer for InteractivePrinter<'_> {
                 }
             }
 
-            // If ANSI escape sequences are supposed to be stripped, do it before syntax highlighting.
-            if self.strip_ansi {
+            // Sanitize is the strict superset; otherwise strip-ansi alone.
+            if self.sanitize {
+                line = sanitize(&line).into()
+            } else if self.strip_ansi {
                 line = strip_ansi(&line).into()
             }
 
@@ -793,7 +834,7 @@ impl Printer for InteractivePrinter<'_> {
 
                             for c in text.chars() {
                                 // calculate the displayed width for next character
-                                let cw = c.width().unwrap_or(0);
+                                let cw = char_width(c);
                                 current_width += cw;
 
                                 // Track whitespace positions for word wrapping.
@@ -868,10 +909,8 @@ impl Printer for InteractivePrinter<'_> {
                                     if let Some(rs) = rest_start {
                                         // Word wrap: carry remainder to next line.
                                         let remainder = line_buf[rs..].to_string();
-                                        let rem_width: usize = remainder
-                                            .chars()
-                                            .map(|ch| ch.width().unwrap_or(0))
-                                            .sum();
+                                        let rem_width: usize =
+                                            remainder.chars().map(char_width).sum();
                                         line_buf.clear();
                                         line_buf.push_str(&remainder);
                                         current_width = rem_width + cw;

src/syntax_mapping.rs

@@ -17,9 +17,16 @@ use ignored_suffixes::IgnoredSuffixes;
 mod builtin;
 pub mod ignored_suffixes;
 
-fn make_glob_matcher(from: &str) -> Result<GlobMatcher> {
+/// Whether a glob pattern should be matched case-sensitively or case-insensitively.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum Case {
+    Sensitive,
+    Insensitive,
+}
+
+fn make_glob_matcher(from: &str, case: Case) -> Result<GlobMatcher> {
     let matcher = GlobBuilder::new(from)
-        .case_insensitive(true)
+        .case_insensitive(matches!(case, Case::Insensitive))
         .literal_separator(true)
         .build()?
         .compile_matcher();
@@ -97,7 +104,14 @@ impl<'a> SyntaxMapping<'a> {
     }
 
     pub fn insert(&mut self, from: &str, to: MappingTarget<'a>) -> Result<()> {
-        let matcher = make_glob_matcher(from)?;
+        let matcher = make_glob_matcher(from, Case::Insensitive)?;
+        self.custom_mappings.push((matcher, to));
+        Ok(())
+    }
+
+    /// Like [`Self::insert`], but the glob pattern is matched case-sensitively.
+    pub fn insert_case_sensitive(&mut self, from: &str, to: MappingTarget<'a>) -> Result<()> {
+        let matcher = make_glob_matcher(from, Case::Sensitive)?;
         self.custom_mappings.push((matcher, to));
         Ok(())
     }
@@ -261,4 +275,41 @@ mod tests {
             Some(MappingTarget::MapTo("alpha"))
         );
     }
+
+    #[test]
+    fn case_sensitive_custom_mappings_work() {
+        let mut map = SyntaxMapping::new();
+        map.insert_case_sensitive("MY_SPECIAL_FILE", MappingTarget::MapTo("Python"))
+            .ok();
+
+        // Exact case matches
+        assert_eq!(
+            map.get_syntax_for("/path/to/MY_SPECIAL_FILE"),
+            Some(MappingTarget::MapTo("Python"))
+        );
+        // Different case should NOT match the case-sensitive rule
+        assert_eq!(map.get_syntax_for("/path/to/my_special_file"), None);
+        assert_eq!(map.get_syntax_for("/path/to/My_Special_File"), None);
+    }
+
+    #[test]
+    fn builtin_mappings_build_is_case_sensitive() {
+        let map = SyntaxMapping::new();
+
+        // "BUILD" (uppercase) should map to Python via case-sensitive builtin
+        assert_eq!(
+            map.get_syntax_for("/path/to/BUILD"),
+            Some(MappingTarget::MapTo("Python"))
+        );
+        // "build" (lowercase) should still map to MapToUnknown
+        assert_eq!(
+            map.get_syntax_for("/path/to/build"),
+            Some(MappingTarget::MapToUnknown)
+        );
+        // Mixed case should NOT match the Python rule
+        assert_eq!(
+            map.get_syntax_for("/path/to/Build"),
+            Some(MappingTarget::MapToUnknown)
+        );
+    }
 }

src/syntax_mapping/builtin.rs

@@ -3,7 +3,7 @@ use std::env;
 use globset::GlobMatcher;
 use once_cell::sync::Lazy;
 
-use crate::syntax_mapping::{make_glob_matcher, MappingTarget};
+use crate::syntax_mapping::{make_glob_matcher, Case, MappingTarget};
 
 // Static syntax mappings generated from /src/syntax_mapping/builtins/ by the
 // build script (/build/syntax_mapping.rs).
@@ -53,8 +53,8 @@ include!(concat!(
 /// A failure to compile is a fatal error.
 ///
 /// Used internally by `Lazy<Option<GlobMatcher>>`'s lazy evaluation closure.
-fn build_matcher_fixed(from: &str) -> GlobMatcher {
-    make_glob_matcher(from).expect("A builtin fixed glob matcher failed to compile")
+fn build_matcher_fixed(from: &str, case: Case) -> GlobMatcher {
+    make_glob_matcher(from, case).expect("A builtin fixed glob matcher failed to compile")
 }
 
 /// Join a list of matcher segments to create a glob string, replacing all
@@ -64,7 +64,7 @@ fn build_matcher_fixed(from: &str) -> GlobMatcher {
 /// to compile.
 ///
 /// Used internally by `Lazy<Option<GlobMatcher>>`'s lazy evaluation closure.
-fn build_matcher_dynamic(segs: &[MatcherSegment]) -> Option<GlobMatcher> {
+fn build_matcher_dynamic(segs: &[MatcherSegment], case: Case) -> Option<GlobMatcher> {
     // join segments
     let mut buf = String::new();
     for seg in segs {
@@ -77,7 +77,7 @@ fn build_matcher_dynamic(segs: &[MatcherSegment]) -> Option<GlobMatcher> {
         }
     }
     // compile glob matcher
-    let matcher = make_glob_matcher(&buf).ok()?;
+    let matcher = make_glob_matcher(&buf, case).ok()?;
     Some(matcher)
 }
 

src/syntax_mapping/builtins/README.md

@@ -20,12 +20,10 @@ syntax mappings defined by all TOML files, and embed them into the binary.
 
 ## File syntax
 
-Each TOML file should contain a single section named `mappings`, with each of
-its keys being a language identifier (first column of `bat -L`; also referred to
-as "target").
+Each TOML file should contain a single section named `mappings`, with each of its keys being a language
+identifier (first column of `bat -L`; also referred to as "target").
 
-The value of each key should be an array of strings, with each item being a glob
-matcher. We will call each of these items a "rule".
+The value of each key should be an array of "rules". The rules are expected to be objects with a `glob` string and a `case_sensitive` boolean. For simplification, a rule can be just a glob string, which is shorthand for the default case insensitive mode.
 
 For example, if `foo-application` uses both TOML and YAML configuration files,
 we could write something like this:
@@ -98,6 +96,15 @@ like this:
 ]
 ```
 
+### Case sensitivity
+
+By default, all glob patterns are matched case-insensitively. To match a pattern case-sensitively, use the object form of the rule with the `case_sensitive` option:
+
+```toml
+[mappings]
+"Python" = [{ glob = "BUILD", case_sensitive = true }]
+```
+
 ## Ordering
 
 At compile time, all TOML files applicable to the target are processed in

src/syntax_mapping/builtins/common/50-bazel.toml

@@ -0,0 +1,2 @@
+[mappings]
+"Python" = [{ glob = "BUILD", case_sensitive = true }]

src/syntax_mapping/builtins/common/50-dotnet-xml.toml

@@ -1,2 +1,2 @@
 [mappings]
-"XML" = ["*.csproj", "*.vbproj", "*.props", "*.targets"]
+"XML" = ["*.csproj", "*.vbproj", "*.props", "*.targets", "*.slnx"]

src/syntax_mapping/builtins/common/50-json.toml

@@ -1,3 +1,3 @@
 # JSON Lines is a simple variation of JSON #2535
 [mappings]
-"JSON" = ["*.jsonl", "*.jsonc", "*.jsonld", "*.geojson", "*.ndjson"]
+"JSON" = ["*.jsonl", "*.jsonc", "*.jsonld", "*.geojson", "*.ndjson", "*.code-workspace"]

src/syntax_mapping/builtins/common/50-just.toml

@@ -0,0 +1,2 @@
+[mappings]
+"Makefile" = ["justfile", "Justfile", ".justfile", "*.justfile"]

src/syntax_mapping/builtins/common/50-ssh.toml

@@ -1,2 +1,2 @@
 [mappings]
-"SSH Config" = ["**/.ssh/config"]
+"SSH Config" = ["**/.ssh/**/config"]

src/syntax_mapping/builtins/linux/50-dnf.toml

@@ -0,0 +1,2 @@
+[mappings]
+"INI" = ["/etc/dnf/dnf.conf", "/etc/yum.repos.d/*.repo"]

src/syntax_mapping/builtins/unix-family/50-ghostty.toml

@@ -0,0 +1,2 @@
+[mappings]
+"INI" = ["**/ghostty/**/*.ghostty", "**/ghostty/themes/*"]

src/vscreen.rs

@@ -386,12 +386,23 @@ impl<'a> EscapeSequenceOffsetsIterator<'a> {
     }
 
     fn next_text(&mut self) -> Option<EscapeSequenceOffsets> {
-        self.chars_take_while(|c| c != '\x1B')
+        self.chars_take_while(|c| !is_sequence_introducer(c))
             .map(|(start, end)| EscapeSequenceOffsets::Text { start, end })
     }
 
     fn next_sequence(&mut self) -> Option<EscapeSequenceOffsets> {
         let (start_sequence, c) = self.chars.next().expect("to not be finished");
+
+        // Handle 8-bit C1 introducers as their 7-bit `ESC <x>` equivalents.
+        match c {
+            '\u{9B}' => return self.next_csi_body(start_sequence),
+            '\u{9D}' => return self.next_osc_body(start_sequence),
+            '\u{90}' | '\u{98}' | '\u{9E}' | '\u{9F}' => {
+                return self.next_string_terminated_body(start_sequence)
+            }
+            _ => {}
+        }
+
         match self.chars.peek() {
             None => Some(EscapeSequenceOffsets::Unknown {
                 start: start_sequence,
@@ -400,12 +411,24 @@ impl<'a> EscapeSequenceOffsetsIterator<'a> {
 
             Some((_, ']')) => self.next_osc(start_sequence),
             Some((_, '[')) => self.next_csi(start_sequence),
-            Some((i, c)) => match c {
+            // 7-bit DCS/SOS/PM/APC: `ESC P/X/^/_` introduces a string body.
+            Some((_, 'P' | 'X' | '^' | '_')) => {
+                self.chars.next();
+                self.next_string_terminated_body(start_sequence)
+            }
+            Some(&(i, c)) => match c {
                 '\x20'..='\x2F' => self.next_nf(start_sequence),
-                c => Some(EscapeSequenceOffsets::Unknown {
-                    start: start_sequence,
-                    end: i + c.len_utf8(),
-                }),
+                c => {
+                    // Single-byte ESC sequence (RIS, DECSC/DECRC, keypad, VT52 etc.).
+                    let end = match self.chars.next() {
+                        Some((j, fc)) => j + fc.len_utf8(),
+                        None => i + c.len_utf8(),
+                    };
+                    Some(EscapeSequenceOffsets::Unknown {
+                        start: start_sequence,
+                        end,
+                    })
+                }
             },
         }
     }
@@ -413,12 +436,27 @@ impl<'a> EscapeSequenceOffsetsIterator<'a> {
     fn next_osc(&mut self, start_sequence: usize) -> Option<EscapeSequenceOffsets> {
         let (osc_open_index, osc_open_char) = self.chars.next().expect("to not be finished");
         debug_assert_eq!(osc_open_char, ']');
+        let start_command = osc_open_index + osc_open_char.len_utf8();
+        Some(self.read_osc_body(start_sequence, start_command))
+    }
 
+    /// OSC body parser entered after the 8-bit introducer U+009D was consumed.
+    fn next_osc_body(&mut self, start_sequence: usize) -> Option<EscapeSequenceOffsets> {
+        let start_command = start_sequence + '\u{9D}'.len_utf8();
+        Some(self.read_osc_body(start_sequence, start_command))
+    }
+
+    fn read_osc_body(
+        &mut self,
+        start_sequence: usize,
+        start_command: usize,
+    ) -> EscapeSequenceOffsets {
         let mut start_terminator: usize;
         let mut end_sequence: usize;
 
         loop {
-            match self.chars_take_while(|c| !matches!(c, '\x07' | '\x1B')) {
+            // ST is BEL, ESC `\\`, or U+009C.
+            match self.chars_take_while(|c| !matches!(c, '\x07' | '\x1B' | '\u{9C}')) {
                 None => {
                     start_terminator = self.text.len();
                     end_sequence = start_terminator;
@@ -437,6 +475,11 @@ impl<'a> EscapeSequenceOffsetsIterator<'a> {
                     break;
                 }
 
+                Some((ti, '\u{9C}')) => {
+                    end_sequence = ti + '\u{9C}'.len_utf8();
+                    break;
+                }
+
                 Some((ti, '\x1B')) => {
                     match self.chars.next() {
                         Some((i, '\\')) => {
@@ -466,20 +509,82 @@ impl<'a> EscapeSequenceOffsetsIterator<'a> {
             }
         }
 
-        Some(EscapeSequenceOffsets::OSC {
+        EscapeSequenceOffsets::OSC {
             start_sequence,
-            start_command: osc_open_index + osc_open_char.len_utf8(),
+            start_command,
             start_terminator,
             end: end_sequence,
+        }
+    }
+
+    /// DCS/SOS/PM/APC body parser. Emitted as `Unknown` so the body is stripped.
+    fn next_string_terminated_body(
+        &mut self,
+        start_sequence: usize,
+    ) -> Option<EscapeSequenceOffsets> {
+        let mut end_sequence: usize;
+
+        loop {
+            match self.chars_take_while(|c| !matches!(c, '\x07' | '\x1B' | '\u{9C}')) {
+                None => {
+                    end_sequence = self.text.len();
+                    break;
+                }
+                Some((_, end)) => {
+                    end_sequence = end;
+                }
+            }
+
+            match self.chars.next() {
+                Some((ti, '\x07')) => {
+                    end_sequence = ti + '\x07'.len_utf8();
+                    break;
+                }
+                Some((ti, '\u{9C}')) => {
+                    end_sequence = ti + '\u{9C}'.len_utf8();
+                    break;
+                }
+                Some((ti, '\x1B')) => match self.chars.next() {
+                    Some((i, '\\')) => {
+                        end_sequence = i + '\\'.len_utf8();
+                        break;
+                    }
+                    None => {
+                        end_sequence = ti + '\x1B'.len_utf8();
+                        break;
+                    }
+                    _ => {}
+                },
+                None => break,
+                Some((_, tc)) => {
+                    panic!("this should not be reached: char {tc:?}")
+                }
+            }
+        }
+
+        Some(EscapeSequenceOffsets::Unknown {
+            start: start_sequence,
+            end: end_sequence,
         })
     }
 
     fn next_csi(&mut self, start_sequence: usize) -> Option<EscapeSequenceOffsets> {
         let (csi_open_index, csi_open_char) = self.chars.next().expect("to not be finished");
         debug_assert_eq!(csi_open_char, '[');
+        Some(self.read_csi_body(start_sequence, csi_open_index + csi_open_char.len_utf8()))
+    }
 
-        let start_parameters: usize = csi_open_index + csi_open_char.len_utf8();
+    /// CSI body parser entered after the 8-bit introducer U+009B was consumed.
+    fn next_csi_body(&mut self, start_sequence: usize) -> Option<EscapeSequenceOffsets> {
+        let start_parameters = start_sequence + '\u{9B}'.len_utf8();
+        Some(self.read_csi_body(start_sequence, start_parameters))
+    }
 
+    fn read_csi_body(
+        &mut self,
+        start_sequence: usize,
+        start_parameters: usize,
+    ) -> EscapeSequenceOffsets {
         // Keep iterating while within the range of `0x30-0x3F`.
         let mut start_intermediates: usize = start_parameters;
         if let Some((_, end)) = self.chars_take_while(|c| matches!(c, '\x30'..='\x3F')) {
@@ -498,13 +603,13 @@ impl<'a> EscapeSequenceOffsetsIterator<'a> {
             Some((i, c)) => i + c.len_utf8(),
         };
 
-        Some(EscapeSequenceOffsets::CSI {
+        EscapeSequenceOffsets::CSI {
             start_sequence,
             start_parameters,
             start_intermediates,
             start_final_byte,
             end: end_of_sequence,
-        })
+        }
     }
 
     fn next_nf(&mut self, start_sequence: usize) -> Option<EscapeSequenceOffsets> {
@@ -543,13 +648,25 @@ impl Iterator for EscapeSequenceOffsetsIterator<'_> {
     type Item = EscapeSequenceOffsets;
     fn next(&mut self) -> Option<Self::Item> {
         match self.chars.peek() {
-            Some((_, '\x1B')) => self.next_sequence(),
+            Some((_, c)) if is_sequence_introducer(*c) => self.next_sequence(),
             Some((_, _)) => self.next_text(),
             None => None,
         }
     }
 }
 
+/// True for ESC and the 8-bit C1 sequence introducers (DCS/SOS/CSI/OSC/PM/APC).
+#[inline]
+fn is_sequence_introducer(c: char) -> bool {
+    if (c as u32) < 0x80 {
+        return c == '\x1B';
+    }
+    matches!(
+        c,
+        '\u{90}' | '\u{98}' | '\u{9B}' | '\u{9D}' | '\u{9E}' | '\u{9F}'
+    )
+}
+
 /// An iterator over ANSI/VT escape sequences within a string.
 ///
 /// ## Example
@@ -717,6 +834,79 @@ mod tests {
         );
     }
 
+    #[test]
+    fn test_escape_sequence_offsets_iterator_parses_8bit_csi() {
+        let mut iter = EscapeSequenceOffsetsIterator::new("\u{9B}31m");
+        assert_eq!(
+            iter.next(),
+            Some(EscapeSequenceOffsets::CSI {
+                start_sequence: 0,
+                start_parameters: 2,
+                start_intermediates: 4,
+                start_final_byte: 4,
+                end: 5,
+            })
+        );
+        assert_eq!(iter.next(), None);
+    }
+
+    #[test]
+    fn test_escape_sequence_offsets_iterator_parses_8bit_osc_with_8bit_st() {
+        let mut iter = EscapeSequenceOffsetsIterator::new("\u{9D}0;title\u{9C}");
+        assert_eq!(
+            iter.next(),
+            Some(EscapeSequenceOffsets::OSC {
+                start_sequence: 0,
+                start_command: 2,
+                start_terminator: 9,
+                end: 11,
+            })
+        );
+        assert_eq!(iter.next(), None);
+    }
+
+    #[test]
+    fn test_escape_sequence_offsets_iterator_parses_7bit_dcs_consumes_body() {
+        let mut iter = EscapeSequenceOffsetsIterator::new("\x1BP1;0;|payload\x1B\\rest");
+        assert_eq!(
+            iter.next(),
+            Some(EscapeSequenceOffsets::Unknown { start: 0, end: 16 })
+        );
+        assert_eq!(
+            iter.next(),
+            Some(EscapeSequenceOffsets::Text { start: 16, end: 20 })
+        );
+        assert_eq!(iter.next(), None);
+    }
+
+    #[test]
+    fn test_escape_sequence_offsets_iterator_8bit_dcs_consumes_body() {
+        let mut iter = EscapeSequenceOffsetsIterator::new("\u{90}body\u{9C}rest");
+        assert_eq!(
+            iter.next(),
+            Some(EscapeSequenceOffsets::Unknown { start: 0, end: 8 })
+        );
+        assert_eq!(
+            iter.next(),
+            Some(EscapeSequenceOffsets::Text { start: 8, end: 12 })
+        );
+    }
+
+    #[test]
+    fn test_escape_sequence_offsets_iterator_truncated_dcs_consumes_to_eof() {
+        // Unterminated DCS must still be consumed, not emitted as `Text`.
+        let input = "\x1BPno-terminator";
+        let mut iter = EscapeSequenceOffsetsIterator::new(input);
+        assert_eq!(
+            iter.next(),
+            Some(EscapeSequenceOffsets::Unknown {
+                start: 0,
+                end: input.len(),
+            })
+        );
+        assert_eq!(iter.next(), None);
+    }
+
     #[test]
     fn test_escape_sequence_offsets_iterator_parses_csi() {
         let mut iter = EscapeSequenceOffsetsIterator::new("\x1B[m");