From a734713c427db630238b9ae2632eb21798dc972b Mon Sep 17 00:00:00 2001
From: David Heinemeier Hansson <david@hey.com>
Date: Fri, 31 Jul 2026 19:13:52 -0700
Subject: [PATCH] Keep control escapes safe in SSID labels

---
 shell/plugins/panels/network/Model.js | 23 +++++++++++++----------
 test/shell.d/network-test.sh          |  6 ++++--
 2 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/shell/plugins/panels/network/Model.js b/shell/plugins/panels/network/Model.js
index e2ea2592..6ab63bf9 100644
--- a/shell/plugins/panels/network/Model.js
+++ b/shell/plugins/panels/network/Model.js
@@ -92,18 +92,21 @@ function parseBandStatus(raw) {
 
 function decodeIwSsid(value) {
   var raw = String(value || "")
-  var encoded = ""
-
-  for (var i = 0; i < raw.length; i++) {
-    if (raw[i] === "\\" && raw[i + 1] === "x" && /^[0-9a-f]{2}$/i.test(raw.substring(i + 2, i + 4))) {
-      encoded += "%" + raw.substring(i + 2, i + 4)
-      i += 3
-    } else {
-      encoded += encodeURIComponent(raw[i])
-    }
-  }
 
   try {
+    var encoded = ""
+
+    for (var i = 0; i < raw.length; i++) {
+      if (raw[i] === "\\" && raw[i + 1] === "x" && /^[0-9a-f]{2}$/i.test(raw.substring(i + 2, i + 4))) {
+        var hex = raw.substring(i + 2, i + 4)
+        var byte = parseInt(hex, 16)
+        encoded += byte < 32 || byte === 127 ? encodeURIComponent(raw.substring(i, i + 4)) : "%" + hex
+        i += 3
+      } else {
+        encoded += encodeURIComponent(raw[i])
+      }
+    }
+
     return decodeURIComponent(encoded)
   } catch (error) {
     return raw
diff --git a/test/shell.d/network-test.sh b/test/shell.d/network-test.sh
index 7807c5b7..99df2a92 100644
--- a/test/shell.d/network-test.sh
+++ b/test/shell.d/network-test.sh
@@ -27,13 +27,15 @@ assertDeepEqual(
   'network parses detail key values'
 )
 assertEqual(network.decodeIwSsid('Cafe\\xe2\\x80\\x99'), 'Cafe’', 'network decodes UTF-8 SSID bytes')
+assertEqual(network.decodeIwSsid('Smile \\xf0\\x9f\\x98\\x80'), 'Smile 😀', 'network decodes emoji SSID bytes')
 assertEqual(network.decodeIwSsid('\\x20Cafe\\x20'), ' Cafe ', 'network preserves edge spaces in SSIDs')
 assertEqual(network.decodeIwSsid('slash\\x5cname'), 'slash\\name', 'network decodes SSID backslashes once')
 assertEqual(network.decodeIwSsid('invalid\\xff'), 'invalid\\xff', 'network preserves invalid UTF-8 escapes')
+assertEqual(network.decodeIwSsid('already 😀'), 'already 😀', 'network safely preserves unexpected non-BMP input')
 assertDeepEqual(
   network.parseKeyValue('ssid\tline\\x0abreak\\x09tab\\x00nul\nsignal_dbm\t-40\n'),
-  { ssid: 'line\nbreak\ttab\0nul', signal_dbm: '-40' },
-  'network decodes control bytes after parsing detail records'
+  { ssid: 'line\\x0abreak\\x09tab\\x00nul', signal_dbm: '-40' },
+  'network leaves control-byte escapes safe for single-line display'
 )
 assertDeepEqual(
   network.throughputState({ prevIface: '', prevSampleTime: 0 }, { iface: 'wlan0', rx_bytes: '100', tx_bytes: '50' }, 10),