Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/hchen90/tcell/v2
Please see here for an important message for the people of Russia.
Tcell is a Go package that provides a cell based view for text terminals, like XTerm. It was inspired by termbox, but includes many additional improvements.
NOTE: This is version 2 of Tcell. There are breaking changes relative to version 1.
Version 1.x remains available using the import github.com/gdamore/tcell
.
A brief, and still somewhat rough, tutorial is available.
Tcell includes a full parser and expander for terminfo capability strings, so that it can avoid hard coding escape strings for formatting. It also favors portability, and includes support for all POSIX systems.
The database is also flexible & extensible, and can be modified by either running a program to build the entire database, or an entry for just a single terminal.
Tcell is portable to a wide variety of systems, and is pure Go, without any need for CGO. Tcell is believed to work with mainstream systems officially supported by golang.
Tcell is able to operate without requiring SIGIO
signals (unlike termbox),
or asynchronous I/O, and can instead use standard Go file objects and Go routines.
This means it should be safe, especially for
use with programs that use exec, or otherwise need to manipulate the tty streams.
This model is also much closer to idiomatic Go, leading to fewer surprises.
Tcell includes enhanced support for Unicode, including wide characters and combining characters, provided your terminal can support them. Note that Windows terminals generally don't support the full Unicode repertoire.
It will also convert to and from Unicode locales, so that the program can work with UTF-8 internally, and get reasonable output in other locales. Tcell tries hard to convert to native characters on both input and output. On output Tcell even makes use of the alternate character set to facilitate drawing certain characters.
Tcell also has richer support for a larger number of special keys that some terminals can send.
Tcell will respect your terminal's color space as specified within your terminfo entries. For example attempts to emit color sequences on VT100 terminals won't result in unintended consequences.
In legacy Windows mode, Tcell supports 16 colors, bold, dim, and reverse, instead of just termbox's 8 colors with reverse. (Note that there is some conflation with bold/dim and colors.) Modern Windows 10 can benefit from much richer colors however.
Tcell maps 16 colors down to 8, for terminals that need it. (The upper 8 colors are just brighter versions of the lower 8.)
Tcell supports enhanced mouse tracking mode, so your application can receive regular mouse motion events, and wheel events, if your terminal supports it.
(Note: The Windows 10 Terminal application suffers from a flaw in this regard, and does not support mouse interaction. The stock Windows 10 console host fired up with cmd.exe or PowerShell works fine however.)
A compatibility layer for termbox is provided in the compat
directory.
To use it, try importing github.com/gdamore/tcell/termbox
instead.
Most termbox-go programs will probably work without further modification.
Internally Tcell uses UTF-8, just like Go.
However, Tcell understands how to
convert to and from other character sets, using the capabilities of
the golang.org/x/text/encoding packages
.
Your application must supply
them, as the full set of the most common ones bloats the program by about 2 MB.
If you're lazy, and want them all anyway, see the encoding
sub-directory.
The SetContent()
API takes a primary rune, and an optional list of combining runes.
If any of the runes is a wide (East Asian) rune occupying two cells,
then the library will skip output from the following cell. Care must be
taken in the application to avoid explicitly attempting to set content in the
next cell, otherwise the results are undefined. (Normally the wide character
is displayed, and the other character is not; do not depend on that behavior.)
Older terminal applications (especially on systems like Windows 8) lack support for advanced Unicode, and thus may not fare well.
Tcell assumes the ANSI/XTerm color model, including the 256 color map that
XTerm uses when it supports 256 colors. The terminfo guidance will be
honored, with respect to the number of colors supported. Also, only
terminals which expose ANSI style setaf
and setab
will support color;
if you have a color terminal that only has setf
and setb
, please submit
a ticket.
Tcell supports 24-bit color! (That is, if your terminal can support it.)
NOTE: Technically the approach of using 24-bit RGB values for color is more accurately described as "direct color", but most people use the term "true color". We follow the (inaccurate) common convention.
There are a few ways you can enable (or disable) true color.
For many terminals, we can detect it automatically if your terminal
includes the RGB
or Tc
capabilities (or rather it did when the database
was updated.)
You can force this one by setting the COLORTERM
environment variable to
24-bit
, truecolor
or 24bit
. This is the same method used
by most other terminal applications that support 24-bit color.
If you set your TERM
environment variable to a value with the suffix -truecolor
then 24-bit color compatible with XTerm and ECMA-48 will be assumed.
(This feature is deprecated.
It is recommended to use one of other methods listed above.)
You can disable 24-bit color by setting TCELL_TRUECOLOR=disable
in your
environment.
When using TrueColor, programs will display the colors that the programmer
intended, overriding any "themes
" you may have set in your terminal
emulator. (For some cases, accurate color fidelity is more important
than respecting themes. For other cases, such as typical text apps that
only use a few colors, its more desirable to respect the themes that
the user has established.)
Reasonable attempts have been made to minimize sending data to terminals, avoiding repeated sequences or drawing the same cell on refresh updates.
(Not relevant for Windows users.)
The Terminfo implementation operates with a built-in database.
This should satisfy most users. However, it can also (on systems
with ncurses installed), dynamically parse the output from infocmp
for terminals it does not already know about.
See the terminfo/
directory for more information about generating
new entries for the built-in database.
Tcell requires that the terminal support the cup
mode of cursor addressing.
Ancient terminals without the ability to position the cursor directly
are not supported.
This is unlikely to be a problem; such terminals have not been mass-produced
since the early 1970s.
Mouse support is detected via the kmous
terminfo variable, however,
enablement/disablement and decoding mouse events is done using hard coded
sequences based on the XTerm X11 model. All popular
terminals with mouse tracking support this model. (Full terminfo support
is not possible as terminfo sequences are not defined.)
On Windows, the mouse works normally.
Mouse wheel buttons on various terminals are known to work, but the support in terminal emulators, as well as support for various buttons and live mouse tracking, varies widely. Modern xterm, macOS Terminal, and iTerm all work well.
Terminals that appear to support the XTerm mouse model also can support
bracketed paste, for applications that opt-in. See EnablePaste()
for details.
There is a SimulationScreen
, that can be used to simulate a real screen
for automated testing. The supplied tests do this. The simulation contains
event delivery, screen resizing support, and capabilities to inject events
and examine "physical
" screen contents.
Everything works using pure Go on mainstream platforms. Some more esoteric platforms (e.g., AIX) may need to be added. Pull requests are welcome!
Windows console mode applications are supported.
Modern console applications like ConEmu and the Windows 10 terminal, support all the good features (resize, mouse tracking, etc.)
These platforms won't work, but compilation stubs are supplied
for folks that want to include parts of this in software for those
platforms. The Simulation screen works, but as Tcell doesn't know how to
allocate a real screen object on those platforms, NewScreen()
will fail.
If anyone has wisdom about how to improve support for these, please let me know. PRs are especially welcome.
Tcell is absolutely free, but if you want to obtain commercial, professional support, there are options.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.