util: fix OSC 8 hyperlink stripping in stripVTControlCharacters by dushyant-hada-90 · Pull Request #64319 · nodejs/node · GitHub

Summary

The bundled ansi-regex OSC pattern used by stripVTControlCharacters() relied on a restrictive URI character class that failed when OSC 8 hyperlink URIs contained RFC 3986-valid characters such as (, ), !, +, [ and ].

This updates OSC handling to match sequences generically as:

ESC ] ... ST

aligned with ansi-regex v6.2.0.

Problem

stripVTControlCharacters() failed to correctly strip OSC 8 hyperlinks whose URI contained characters omitted from the previous regex character class:

[-a-zA-Z\d/#&.:=?%@~_]

Example:

import { stripVTControlCharacters } from 'node:util';

const link =
  '\u001B]8;;https://example.com/(foo\u0007label\u001B]8;;\u0007';

console.log(stripVTControlCharacters(link));

Actual

ttps://example.com/(foo\u0007label

Expected

label

The OSC match terminated early at (, leaving most of the escape sequence in the output.

Changes

Replace the restrictive OSC URI matcher with generic OSC matching up to the first string terminator (BEL, ESC \, or 0x9C)
Sync the bundled regex behavior with ansi-regex v6.2.0
Preserve existing CSI handling logic

Tests

Added regression coverage in:

test/parallel/test-util-stripvtcontrolcharacters.js

for OSC 8 hyperlinks containing:

(
)
!
+
[ ]

across all supported OSC string terminators.

Notes

Existing CSI handling is unchanged
Fast-path behavior is unchanged
Embedded OSC terminators inside URIs retain previous behavior

Pushed updates addressing the feedback:

Accepted the [;:] CSI parameter separator suggestion (@Archkon) and reworded the commit to follow commit message guidelines
Added regression tests for the remaining RFC 3986 characters ($ ' * ,), colon-delimited CSI sub-parameters, and an unterminated-OSC edge case

Verified the final regex against every added test case and confirmed it now matches upstream ansi-regex v6.2.0 exactly.
Ready for another look

Hi @Archkon, @avivkeller
I've addressed all the feedback from both rounds. The resolved threads are all closed and the regex now matches ansi-regex v6.2.0 exactly. Would really appreciate a re-review or an approval when you get a chance. Happy to make any further changes!

CI: https://ci.nodejs.org/job/node-test-pull-request/75131/

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.14%. Comparing base (00917ba) to head (8bcabf1).
⚠️ Report is 562 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff            @@
##             main   #64319    +/-   ##
========================================
  Coverage   90.14%   90.14%            
========================================
  Files         741      744     +3     
  Lines      242076   242516   +440     
  Branches    45558    45691   +133     
========================================
+ Hits       218216   218613   +397     
- Misses      15385    15409    +24     
- Partials     8475     8494    +19

Files with missing lines	Coverage Δ
lib/internal/util/inspect.js	96.93% <100.00%> (-0.01%)	⬇️

... and 100 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

The bundled ansi-regex OSC pattern used a restrictive URI character class that failed when URIs contained RFC 3986-valid characters such as parentheses. Match OSC sequences generically as ESC ] ... ST, aligned with ansi-regex v6.2.0. Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: dushyant <dushyanthada90@gmail.com>

Co-authored-by: Archkon <180910180+Archkon@users.noreply.github.com> Signed-off-by: dushyant <dushyanthada90@gmail.com>

Signed-off-by: dushyant <dushyanthada90@gmail.com>

Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: dushyant <dushyanthada90@gmail.com>

Remove the extra non-capturing group around CSI parameters and the final byte so the bundled pattern matches ansi-regex at 72bc570 exactly. Refs: https://github.com/chalk/ansi-regex/blob/72bc570aaf25fca25541b49c6a8564f3ec63e835/index.js Signed-off-by: dushyant <dushyanthada90@gmail.com>

The previous comment claimed truncated OSC sequences were left unmatched rather than partially stripped. The CSI alternative can still consume a short prefix, which is why the expected remainder is 'ttps://...'. Update the comment to describe that behavior. Signed-off-by: dushyant <dushyanthada90@gmail.com>

I have updated the commit message to comply with the Node.js commit guidelines, since the previous message was failing CI.
Kindly re-approve CI when convenient.
@avivkeller

CI: https://ci.nodejs.org/job/node-test-pull-request/75280/

Friendly ping,
@Archkon — whenever you have a chance, could you please review and approve this PR if everything looks good? Thank you!

Hi @aduh95 , can you please have a look at this PR when you have a chance? If everything looks good, I'd appreciate your help getting it landed. Thank you!

CI: https://ci.nodejs.org/job/node-test-pull-request/76259/

CI: https://ci.nodejs.org/job/node-test-pull-request/76335/

Landed in 5b316e5

The bundled ansi-regex OSC pattern used a restrictive URI character class that failed when URIs contained RFC 3986-valid characters such as parentheses. Match OSC sequences generically as ESC ] ... ST, aligned with ansi-regex v6.2.0. Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: dushyant <dushyanthada90@gmail.com> PR-URL: #64319 Fixes: #64313 Reviewed-By: Aviv Keller <me@aviv.sh>

nodejs-github-bot added needs-ci PRs that need a full CI run. util Issues and PRs related to the built-in util module. labels Jul 6, 2026

Archkon reviewed Jul 7, 2026

View reviewed changes

dushyant-hada-90 force-pushed the fix/strip-vt-osc-8-uri-chars branch from e3d3cb8 to 9da6ef2 Compare July 8, 2026 05:40

dushyant-hada-90 requested a review from Archkon July 8, 2026 05:45

avivkeller reviewed Jul 20, 2026

View reviewed changes

Comment thread lib/internal/util/inspect.js Outdated

dushyant-hada-90 force-pushed the fix/strip-vt-osc-8-uri-chars branch 2 times, most recently from 711b204 to 7a426b8 Compare July 20, 2026 17:37

avivkeller reviewed Jul 24, 2026

View reviewed changes

Comment thread lib/internal/util/inspect.js

avivkeller approved these changes Jul 25, 2026

View reviewed changes

avivkeller added author ready PRs that have at least one approval, no outstanding review comments, and a CI started. request-ci Add this label to start a Jenkins CI on a PR. labels Jul 25, 2026

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jul 25, 2026

dushyant-hada-90 and others added 6 commits July 27, 2026 00:57

util: use [;:] as CSI parameter separator, matching ansi-regex v6.2.0

273fbfe

Co-authored-by: Archkon <180910180+Archkon@users.noreply.github.com> Signed-off-by: dushyant <dushyanthada90@gmail.com>

util: extend stripVTControlCharacters regression tests

29f6205

Signed-off-by: dushyant <dushyanthada90@gmail.com>

util: use full ansi-regex commit SHA in comment

20fc79d

Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: dushyant <dushyanthada90@gmail.com>

dushyant-hada-90 force-pushed the fix/strip-vt-osc-8-uri-chars branch from a40efe2 to 8bcabf1 Compare July 26, 2026 19:29

avivkeller added the request-ci Add this label to start a Jenkins CI on a PR. label Jul 29, 2026

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jul 29, 2026

This comment was marked as spam.

Sign in to view

trivikr removed the author ready PRs that have at least one approval, no outstanding review comments, and a CI started. label Aug 9, 2026

luantaraschi mentioned this pull request Aug 18, 2026

util: strip whole CSI sequences per ECMA-48 #65379

Open

trivikr requested a review from avivkeller August 21, 2026 00:37

trivikr added the request-ci Add this label to start a Jenkins CI on a PR. label Aug 22, 2026

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Aug 22, 2026

avivkeller approved these changes Aug 23, 2026

View reviewed changes

trivikr added the author ready PRs that have at least one approval, no outstanding review comments, and a CI started. label Aug 23, 2026

This comment was marked as outdated.

Sign in to view

trivikr added commit-queue-squash Add this label to instruct the Commit Queue to squash all the PR commits into the first one. commit-queue Add this label to land a pull request using GitHub Actions. labels Aug 24, 2026

nodejs-github-bot merged commit 5b316e5 into nodejs:main Aug 24, 2026
84 checks passed

nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Aug 24, 2026

aduh95 mentioned this pull request Aug 25, 2026

2026-08-26, Version 26.8.0 (Current) #65551

Open

-                '[\\dA-PR-TZcf-nq-uy=><~]))', 'g',
+                '(?:\\u001B\\][\\s\\S]*?(?:\\u0007|\\u001B\\u005C|\\u009C))' +
+                '|[\\u001B\\u009B][[\\]()#;?]*' +
+                '(?:(?:\\d{1,4}(?:;\\d{0,4})*)?' +

util: fix OSC 8 hyperlink stripping in stripVTControlCharacters by dushyant-hada-90 · Pull Request #64319 · nodejs/node · GitHub

Uh oh!

Uh oh!

util: fix OSC 8 hyperlink stripping in stripVTControlCharacters - #64319

util: fix OSC 8 hyperlink stripping in stripVTControlCharacters#64319nodejs-github-bot merged 6 commits intonodejs:mainnodejs/node:mainfrom dushyant-hada-90:fix/strip-vt-osc-8-uri-charsdushyant-hada-90/node:fix/strip-vt-osc-8-uri-charsCopy head branch name to clipboard

Conversation

dushyant-hada-90 commented Jul 6, 2026

Summary

Problem

Actual

Expected

Changes

Tests

Notes

Uh oh!

This comment was marked as spam.

Uh oh!

Uh oh!

dushyant-hada-90 commented Jul 8, 2026

Uh oh!

Uh oh!

dushyant-hada-90 commented Jul 24, 2026

Uh oh!

Uh oh!

nodejs-github-bot commented Jul 25, 2026

Uh oh!

codecov Bot commented Jul 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

dushyant-hada-90 commented Jul 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nodejs-github-bot commented Jul 29, 2026

Uh oh!

dushyant-hada-90 commented Aug 2, 2026

Uh oh!

This comment was marked as spam.

dushyant-hada-90 commented Aug 4, 2026

Uh oh!

nodejs-github-bot commented Aug 22, 2026

Uh oh!

This comment was marked as outdated.

nodejs-github-bot commented Aug 24, 2026

Uh oh!

Uh oh!

nodejs-github-bot commented Aug 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

util: fix OSC 8 hyperlink stripping in stripVTControlCharacters#64319
nodejs-github-bot merged 6 commits into
nodejs:mainfrom
dushyant-hada-90:fix/strip-vt-osc-8-uri-chars

codecov Bot commented Jul 26, 2026 •
edited
Loading

dushyant-hada-90 commented Jul 26, 2026 •
edited
Loading