Reading this post, titled "Fixing Unix/Linux/POSIX filenames", I came across a VERY interesting phrase by the author, which says:
Oh, and don’t display filenames. Filenames could contain control characters that control the terminal (and X-windows), causing nasty side-effects on display. Displaying filenames can even cause a security vulnerability — and who expects printing a filename to be a vulnerability?!? In addition, you have no way of knowing for certain what the filename’s character encoding is, so if you got a filename from someone else who uses non-ASCII characters, you’re likely to end up with garbage mojibake
I've long suspected this to be the case, because sometimes accidentally running
cat binary_file caused my terminal session to exit, or caused the terminal to
CTRL+L itself, but I never had the knowledge to ask a sufficiently coherent question.
My question is: What output can a program, when executed from a command line, output to generate behavior that could be considered a vulnerability on the terminal emulator?
Please note I am not referring to pasting commands from websites into the command line.