Repository: alacritty/alacritty
File: alacritty/src/event.rs (Rust)

Code before:
        let selection = match &mut self.terminal_mut().selection {
            Some(selection) => selection,
            None => return,
        };

        selection.ty = selection_type;
        self.update_selection(point, cell_side);

        // Move vi mode cursor to mouse click position.
        if self.terminal().mode().contains(TermMode::VI) && !self.search_active() {
            self.terminal_mut().vi_mode_cursor.point = point;
        }
    }

    /// Handle beginning of terminal text input.
    fn on_terminal_input_start(&mut self) {
        self.on_typing_start();
        self.clear_selection();

        if self.terminal().grid().display_offset() != 0 {
            self.scroll(Scroll::Bottom);
        }
    }

    /// Write text into the terminal or widget.
    fn write_str(&mut self, text: &str, mode: WriteStrMode) {
        if self.search_active() {
            for c in text.chars() {
                self.search_input(c);
            }

            return;
        }

        self.on_terminal_input_start();

        match mode {
            WriteStrMode::BracketedOrMultiline => {
                if self.terminal().mode().contains(TermMode::BRACKETED_PASTE) {
                    self.write_to_pty(&b"\x1b[200~"[..]);

                    // Write filtered escape sequences.
                    //
                    // We remove `\x1b` to ensure it's impossible for the pasted text to write the
                    // bracketed paste end escape `\x1b[201~` and `\x03` since
                    // some shells incorrectly terminate bracketed paste when
                    // they receive it.
                    let filtered = text.replace(['\x1b', '\x03'], "");
                    self.write_to_pty(filtered.into_bytes());

                    self.write_to_pty(&b"\x1b[201~"[..]);

Review comment (security):
I was thinking maybe `write_user_input` could be a good name? Since this is specifically about handling text input by the user rather than writing arbitrary strings like escape sequences.

Code after:
            None => return,
        };

        selection.ty = selection_type;
        self.update_selection(point, cell_side);

        // Move vi mode cursor to mouse click position.
        if self.terminal().mode().contains(TermMode::VI) && !self.search_active() {
            self.terminal_mut().vi_mode_cursor.point = point;
        }
    }

    /// Handle beginning of terminal text input.
    fn on_terminal_input_start(&mut self) {
        self.on_typing_start();
        self.clear_selection();

        if self.terminal().grid().display_offset() != 0 {
            self.scroll(Scroll::Bottom);
        }
    }

    /// Paste a text into the terminal.
    fn paste(&mut self, text: &str, bracketed: bool) {
        if self.search_active() {
            for c in text.chars() {
                self.search_input(c);
            }
        } else if bracketed && self.terminal().mode().contains(TermMode::BRACKETED_PASTE) {
            self.on_terminal_input_start();

            self.write_to_pty(&b"\x1b[200~"[..]);

            // Write filtered escape sequences.
            //
            // We remove `\x1b` to ensure it's impossible for the pasted text to write the bracketed
            // paste end escape `\x1b[201~` and `\x03` since some shells incorrectly terminate
            // bracketed paste when they receive it.
            let filtered = text.replace(['\x1b', '\x03'], "");
            self.write_to_pty(filtered.into_bytes());

            self.write_to_pty(&b"\x1b[201~"[..]);
        } else {
            self.on_terminal_input_start();

            let payload = if bracketed {
                // In non-bracketed (ie: normal) mode, terminal applications cannot distinguish
                // pasted data from keystrokes.
                //
                // In theory, we should construct the keystrokes needed to produce the data we are
                // pasting... since that's neither practical nor sensible (and probably an