contrib: Avoid outputting binary data to TTY
What the developer wrote
Authored by Hodlinator
contrib: Avoid outputting binary data to TTY
What changed, and why it matters
A small change to a helper Python script used for building network maps. The script now refuses to write raw binary output directly to a terminal window, because doing so can garble the screen and, in rare cases, cause a terminal to misinterpret control characters. This is a hardening improvement rather than a fix for an active attack.
No urgent action. Treat as routine hardening. Users of asmap-tool.py should redirect encode output to a file or pipe. Review whether the same guard is needed elsewhere in contrib utilities.
Security signals we found
Output sanitization / TTY guard added
Potential terminal control-character injection risk mitigated
No cryptographic, consensus, or network-layer changes
Evidence from the diff
In contrib/asmap/asmap-tool.py, the encode subcommand now checks whether args.outfile is a TTY and exits with an error if so before calling save_binary(). This prevents raw binary ASN-to-IP mapping data from being written to a user’s terminal. The change reduces the risk of terminal escape-sequence injection or screen corruption when a user forgets to redirect output, but it does not address a vulnerability in Bitcoin Core’s network or consensus code.
Changed components
contrib/asmap/asmap-tool.pyInspect captured patch +2 / −0
diff --git a/contrib/asmap/asmap-tool.py b/contrib/asmap/asmap-tool.py
index 33a380a2..3a252119 100755
--- a/contrib/asmap/asmap-tool.py
+++ b/contrib/asmap/asmap-tool.py
@@ -131,6 +131,8 @@ def main():
if args.subcommand is None:
parser.print_help()
elif args.subcommand == "encode":
+ if args.outfile.isatty():
+ sys.exit("Not much use in writing binary to a TTY. Please specify an output file or pipe output to another process.")
state = load_file(args.infile)
save_binary(args.outfile, state, fill=args.fill)
elif args.subcommand == "decode":
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.