Sanitize HTTP status and probe text in errors

The PR sanitized the JSON error body a failed flush renders into a
LineSenderException, but two adjacent untrusted-text paths in the same
file still reached the message raw, so a hostile or proxied endpoint
could splice ANSI/control/bidi bytes into a log line or terminal:

- The "[http-status=...]" field was rendered with put(), not
  putAsPrintable(). The HTTP header parser copies the status-line token
  verbatim between the two spaces, and a non-3-char token bypasses the
  numeric status checks to reach the generic error path, so a crafted
  status line could carry an ESC. Route all four status renders through
  putAsPrintable(); the generic path is the exploitable one, the others
  are defensive. A normal 3-digit status renders unchanged.

- Protocol-version detection concatenated the raw probe response body
  via String +. Build it through putAsPrintable() instead.

Tests:
- LineHttpSenderErrorResponseTest: a malformed status line carrying an
  ESC, and a protocol-probe error body with ESC/bidi/newline; both fail
  without the fix and pass with it.
- DisplaySafeTest: direct coverage for the shared classifier (controls,
  format/bidi/BOM, supplementary tag chars and lone surrogates unsafe;
  printable ASCII and emoji safe) - it previously had none.
- SenderBuilderErrorApiTest: the null-provider guard and the
  provider-then-username/password exclusion, neither tested before.
- OidcDeviceAuthTest: a percent-encoded backslash (%5c/%5C) in the
  issuer-path scope check.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: glasstiger

core/src/main/java/io/questdb/client/cutlass/line/http/AbstractLineHttpSender.java

@@ -334,7 +334,9 @@ public static AbstractLineHttpSender createLineSender(
         if (protocolVersion == PROTOCOL_VERSION_NOT_SET_EXPLICIT) {
             Misc.free(cli);
             if (lastErrorSink != null) {
-                throw new LineSenderException("Failed to detect server line protocol version: " + lastErrorSink);
+                // sanitize the raw server body before it reaches the exception message (and any log/terminal):
+                // a hostile or proxied endpoint must not splice control, ANSI or bidi chars into the render
+                throw new LineSenderException("Failed to detect server line protocol version: ").putAsPrintable(lastErrorSink);
             }
             throw new LineSenderException("Failed to detect server line protocol version");
         }
@@ -841,7 +843,7 @@ private void throwOnHttpErrorResponse(DirectUtf8Sequence statusCode, HttpClient.
                 // an untrusted or proxied endpoint must not splice control, ANSI or bidi chars into the render
                 ex = ex.put(": ").putAsPrintable(sink);
             }
-            ex.put(" [http-status=").put(statusAscii).put(']');
+            ex.put(" [http-status=").putAsPrintable(statusAscii).put(']');
             client.disconnect();
             throw ex;
         }
@@ -862,7 +864,7 @@ private void throwOnHttpErrorResponse(DirectUtf8Sequence statusCode, HttpClient.
         // an untrusted or proxied endpoint must not splice control, ANSI or bidi chars into the render
         LineSenderException ex = new LineSenderException("Could not flush buffer: ", retryable)
                 .putAsPrintable(sink)
-                .put(" [http-status=").put(statusCode.asAsciiCharSequence()).put(']');
+                .put(" [http-status=").putAsPrintable(statusCode.asAsciiCharSequence()).put(']');
         client.disconnect();
         throw ex;
     }
@@ -1032,7 +1034,7 @@ public void onEvent(int code, CharSequence tag, int position) throws JsonExcepti
         private void drainAndReset(LineSenderException sink, DirectUtf8Sequence httpStatus) {
             assert state == State.INIT;
 
-            sink.putAsPrintable(messageSink).put(" [http-status=").put(httpStatus.asAsciiCharSequence());
+            sink.putAsPrintable(messageSink).put(" [http-status=").putAsPrintable(httpStatus.asAsciiCharSequence());
             if (codeSink.length() != 0 || errorIdSink.length() != 0 || lineSink.length() != 0) {
                 if (errorIdSink.length() != 0) {
                     sink.put(", id: ").putAsPrintable(errorIdSink);
@@ -1074,7 +1076,7 @@ LineSenderException toException(Response chunkedRsp, DirectUtf8Sequence httpStat
                     }
                     // sanitize the raw server body before it reaches the exception message (and any log/terminal):
                     // an untrusted or proxied endpoint must not splice control, ANSI or bidi chars into the render
-                    exception.putAsPrintable(jsonSink).put(" [http-status=").put(httpStatus.asAsciiCharSequence()).put(']');
+                    exception.putAsPrintable(jsonSink).put(" [http-status=").putAsPrintable(httpStatus.asAsciiCharSequence()).put(']');
                     reset();
                     return exception;
                 }

core/src/test/java/io/questdb/client/test/SenderBuilderErrorApiTest.java

@@ -264,6 +264,27 @@ public void testHttpTokenProviderIsMutuallyExclusiveWithOtherAuth() {
         }
     }
 
+    @Test
+    public void testHttpTokenProviderNullRejectedAndExclusiveWithLaterUsernamePassword() {
+        // a null provider is rejected up front
+        try {
+            Sender.builder(Sender.Transport.HTTP).address("localhost:9000").httpTokenProvider(null);
+            Assert.fail("expected a null provider to be rejected");
+        } catch (LineSenderException e) {
+            Assert.assertTrue(e.getMessage(), e.getMessage().contains("token provider cannot be null"));
+        }
+        // the reverse of the mutual-exclusion case above: provider first, then username/password. This hits a
+        // distinct guard in httpUsernamePassword(), which the provider-then-token / token-then-provider /
+        // username-then-provider orderings above do not reach
+        try {
+            Sender.builder(Sender.Transport.HTTP).address("localhost:9000")
+                    .httpTokenProvider(() -> "dynamic").httpUsernamePassword("u", "p");
+            Assert.fail("expected token-provider-already-configured");
+        } catch (LineSenderException e) {
+            Assert.assertTrue(e.getMessage(), e.getMessage().contains("token provider authentication is already configured"));
+        }
+    }
+
     @Test
     public void testHttpTokenProviderAcceptedForWebSocket() {
         // the provider is supported over WebSocket (queried at each upgrade handshake): it must pass

core/src/test/java/io/questdb/client/test/cutlass/auth/OidcDeviceAuthTest.java

@@ -1863,6 +1863,10 @@ public void testIssuerPathScopingRejectsSplitEncodedAndBackslashSeparators() thr
         Assert.assertFalse(invokeIsEndpointUnderIssuerPath("https://idp.example.com/realms/acme%2%66evil/token", issuer));
         Assert.assertFalse(invokeIsEndpointUnderIssuerPath("https://idp.example.com/realms/acme%252fevil/token", issuer));
         Assert.assertFalse(invokeIsEndpointUnderIssuerPath("https://idp.example.com/realms/acme\\evil/token", issuer));
+        // a percent-encoded backslash (%5c / %5C) is the encoded form of the literal '\' above; the scan
+        // rejects it at the encoded level too, before decodePathSegments would fold it to '/'
+        Assert.assertFalse(invokeIsEndpointUnderIssuerPath("https://idp.example.com/realms/acme%5cevil/token", issuer));
+        Assert.assertFalse(invokeIsEndpointUnderIssuerPath("https://idp.example.com/realms/acme%5Cevil/token", issuer));
     }
 
     @Test(timeout = 30_000)

core/src/test/java/io/questdb/client/test/cutlass/line/LineHttpSenderErrorResponseTest.java

@@ -51,6 +51,38 @@ public class LineHttpSenderErrorResponseTest {
     // U+202E RIGHT-TO-LEFT OVERRIDE: reorders displayed text (visual spoofing)
     private static final char RLO = 0x202e;
 
+    @Test(timeout = 30_000)
+    public void testProtocolDetectionErrorBodyControlAndBidiAreEscaped() throws Exception {
+        assertMemoryLeak(() -> {
+            // when the caller does not pin a protocol version, build() probes the server for one; a
+            // non-success, non-404 probe response body is captured into the "Failed to detect server line
+            // protocol version" exception. A hostile or proxied endpoint must not splice control, ANSI or
+            // bidi chars into that message any more than into a flush error
+            String errorBody = "probe denied " + ESC + "[2J forged\n" + RLO + "moc.live";
+            try (MockOidcServer server = new MockOidcServer((method, path, body) -> MockOidcServer.chunkedJson(400, errorBody))) {
+                try {
+                    // no protocolVersion(...) -> build() runs the detection probe; retryTimeoutMillis(0) makes
+                    // it give up after the first failed probe instead of retrying to a deadline
+                    Sender.builder(Sender.Transport.HTTP)
+                            .address("127.0.0.1:" + server.port())
+                            .retryTimeoutMillis(0)
+                            .build()
+                            .close();
+                    Assert.fail("expected protocol detection to fail and surface the server body");
+                } catch (LineSenderException e) {
+                    String msg = e.getMessage();
+                    Assert.assertTrue(msg, msg.contains("Failed to detect server line protocol version"));
+                    Assert.assertTrue("visible text must be preserved: " + msg, msg.contains("probe denied"));
+                    Assert.assertTrue("the ESC must be escaped: " + msg, msg.contains("\\u001b"));
+                    Assert.assertTrue("the bidi override must be escaped: " + msg, msg.contains("\\u202e"));
+                    Assert.assertFalse("a raw ESC must not leak: " + msg, msg.indexOf(0x1b) >= 0);
+                    Assert.assertFalse("a raw newline must not leak: " + msg, msg.indexOf('\n') >= 0);
+                    Assert.assertFalse("a raw bidi override must not leak: " + msg, msg.indexOf(0x202e) >= 0);
+                }
+            }
+        });
+    }
+
     @Test(timeout = 30_000)
     public void testServerAuthErrorBodyControlAndBidiAreEscaped() throws Exception {
         assertMemoryLeak(() -> {
@@ -83,6 +115,46 @@ public void testServerAuthErrorBodyControlAndBidiAreEscaped() throws Exception {
         });
     }
 
+    @Test(timeout = 30_000)
+    public void testServerErrorStatusLineControlCharsAreEscaped() throws Exception {
+        assertMemoryLeak(() -> {
+            // the HTTP status-line token is echoed into the exception as "[http-status=...]". The header parser
+            // copies it verbatim between the two spaces, so a hostile or proxied endpoint can smuggle control or
+            // ANSI bytes there; a non-3-char token bypasses the numeric status checks and reaches the generic
+            // error path, so the status render must escape them too, not just the body. A bidi override is a
+            // multi-byte char the raw-response writer's US-ASCII encoding would drop, so this case uses an ESC;
+            // the bidi cases above cover the body
+            String body = "upstream error";
+            // a malformed status code "400<ESC>[m" (6 chars, not 3) carries an ESC between the two spaces;
+            // text/plain keeps it off the JSON parser, so it reaches the generic path that renders the status
+            String rawResponse = "HTTP/1.1 400" + ESC + "[m FORGED\r\n"
+                    + "Content-Type: text/plain\r\n"
+                    + "Transfer-Encoding: chunked\r\n\r\n"
+                    + Integer.toHexString(body.length()) + "\r\n" + body + "\r\n"
+                    + "0\r\n\r\n";
+            try (MockOidcServer server = new MockOidcServer((method, path, b) -> MockOidcServer.raw(rawResponse))) {
+                try (Sender sender = Sender.builder(Sender.Transport.HTTP)
+                        .address("127.0.0.1:" + server.port())
+                        .protocolVersion(Sender.PROTOCOL_VERSION_V1)
+                        .disableAutoFlush()
+                        .build()) {
+                    sender.table("t").longColumn("v", 1L).atNow();
+                    try {
+                        sender.flush();
+                        Assert.fail("expected the server's error to surface as a LineSenderException");
+                    } catch (LineSenderException e) {
+                        String msg = e.getMessage();
+                        Assert.assertTrue(msg, msg.contains("Could not flush buffer"));
+                        // the ESC smuggled into the status token arrives escaped, never as a raw byte that
+                        // could drive an ANSI terminal sequence
+                        Assert.assertTrue("the status-line ESC must be escaped: " + msg, msg.contains("\\u001b"));
+                        Assert.assertFalse("a raw ESC must not leak from the status line: " + msg, msg.indexOf(0x1b) >= 0);
+                    }
+                }
+            }
+        });
+    }
+
     @Test(timeout = 30_000)
     public void testServerJsonErrorBidiAndZeroWidthAreEscaped() throws Exception {
         assertMemoryLeak(() -> {

core/src/test/java/io/questdb/client/test/std/str/DisplaySafeTest.java

@@ -0,0 +1,106 @@
+/*+*****************************************************************************
+ *     ___                  _   ____  ____
+ *    / _ \ _   _  ___  ___| |_|  _ \| __ )
+ *   | | | | | | |/ _ \/ __| __| | | |  _ \
+ *   | |_| | |_| |  __/\__ \ |_| |_| | |_) |
+ *    \__\_\\__,_|\___||___/\__|____/|____/
+ *
+ *  Copyright (c) 2014-2019 Appsicle
+ *  Copyright (c) 2019-2026 QuestDB
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+package io.questdb.client.test.std.str;
+
+import io.questdb.client.std.str.DisplaySafe;
+import org.junit.Assert;
+import org.junit.Test;
+
+/**
+ * Direct coverage for {@link DisplaySafe}, the single source of truth for whether a code point may be shown
+ * verbatim in a terminal or a log line. Both {@code Utf16Sink.putAsPrintable} and the OIDC display sanitizer
+ * delegate to it, so a regression here would silently weaken every display-escaping path - yet the classifier
+ * was previously exercised only transitively, for the few code points the integration tests happen to use.
+ * <p>
+ * The unsafe code points (controls, Unicode format chars, surrogates, bidi controls, the BOM) are written as
+ * hex literals so this source stays pure ASCII and carries none of the chars it asserts on.
+ */
+public class DisplaySafeTest {
+
+    @Test
+    public void testC0C1ControlsAndDelAreUnsafe() {
+        // C0 (incl. TAB/LF/CR/ESC), DEL, and the C1 block: every ISO control must be escaped
+        int[] unsafe = {0x00, 0x07, 0x08, 0x09, 0x0A, 0x0D, 0x1B, 0x1F, 0x7F, 0x80, 0x90, 0x9F};
+        for (int cp : unsafe) {
+            String hex = "0x" + Integer.toHexString(cp);
+            Assert.assertFalse("control " + hex + " must be unsafe", DisplaySafe.isDisplaySafe(cp));
+            Assert.assertTrue("control " + hex + " must be unsafe", DisplaySafe.isUnsafeForDisplay(cp));
+        }
+    }
+
+    @Test
+    public void testFormatBidiAndBomAreUnsafe() {
+        // Cf format chars and the explicit bidi/BOM set that reorder, hide, or mark text - including the
+        // supplementary-plane "tag" chars that arrive as a surrogate pair and must be judged whole
+        int[] unsafe = {
+                0x00AD, // soft hyphen
+                0x200B, // zero-width space
+                0x200E, 0x200F, // LRM, RLM
+                0x202A, 0x202B, 0x202C, 0x202D, 0x202E, // LRE, RLE, PDF, LRO, RLO
+                0x2066, 0x2067, 0x2068, 0x2069, // LRI, RLI, FSI, PDI
+                0xFEFF, // BOM / zero-width no-break space
+                0xE0001, // language tag
+                0xE0020, 0xE007F // tag space, cancel tag
+        };
+        for (int cp : unsafe) {
+            String hex = "0x" + Integer.toHexString(cp);
+            Assert.assertTrue("format " + hex + " must be unsafe", DisplaySafe.isUnsafeForDisplay(cp));
+            Assert.assertFalse("format " + hex + " must be unsafe", DisplaySafe.isDisplaySafe(cp));
+        }
+    }
+
+    @Test
+    public void testLoneSurrogatesAreUnsafe() {
+        // a lone surrogate half has no displayable meaning; the code-point classifier must reject it
+        int[] surrogates = {0xD800, 0xDBFF, 0xDC00, 0xDFFF};
+        for (int cp : surrogates) {
+            Assert.assertFalse("surrogate 0x" + Integer.toHexString(cp) + " must be unsafe", DisplaySafe.isDisplaySafe(cp));
+        }
+    }
+
+    @Test
+    public void testPrintableAsciiIsSafe() {
+        // the fast-path range 0x20..0x7e is the overwhelmingly common case and must always pass
+        for (int cp = 0x20; cp <= 0x7e; cp++) {
+            String hex = "0x" + Integer.toHexString(cp);
+            Assert.assertTrue("printable ASCII " + hex + " must be safe", DisplaySafe.isDisplaySafe(cp));
+            Assert.assertFalse("printable ASCII " + hex + " must be safe", DisplaySafe.isUnsafeForDisplay(cp));
+        }
+    }
+
+    @Test
+    public void testPrintableSupplementaryCharsAreSafe() {
+        // a normal supplementary char (emoji, CJK extension) is neither control, format, nor surrogate and
+        // stays safe, so the classifier does not over-escape legitimate non-BMP text
+        int[] safe = {
+                0x1F600, // grinning face emoji
+                0x1F4A9, // pile of poo
+                0x20000  // CJK Extension B ideograph
+        };
+        for (int cp : safe) {
+            Assert.assertTrue("supplementary 0x" + Integer.toHexString(cp) + " must be safe", DisplaySafe.isDisplaySafe(cp));
+        }
+    }
+}