GHSA-4fmm-95pf-32c6 (CWE-150): on an empty store, Ask returns RenderNoMatches(req.Question) with the question raw, while RenderCitedMatches sanitises it, and both return paths put req.Question raw into AskResult.Question (the --json field), so ESC, C1, bidi-override and zero-width runes in the argv reach stdout (reproduced at v0.7.0: two raw ESC bytes and a raw U+202E on stdout). The fix must sanitise the question once in Ask through termsafe.Sanitize and feed that one value to both renders and the JSON field, pinned by a test that plants ESC and U+202E and proves neither survives in the answer or the question field.

GHSA-4fmm-95pf-32c6 (CWE-150): on an empty store, Ask returns RenderNoMatches(req.Question) with the question raw, while RenderCitedMatches sanitises it, and both return paths put req.Question raw into AskResult.Question (the --json field), so ESC, C1, bidi-override and zero-width runes in the argv reach stdout (reproduced at v0.7.0: two raw ESC bytes and a raw U+202E on stdout). The fix must sanitise the question once in Ask through termsafe.Sanitize and feed that one value to both renders and the JSON field, pinned by a test that plants ESC and U+202E and proves neither survives in the answer or the question field.

Grounds

• pursued: one sanitiser at the point the question is first echoed, so the two renders and the JSON field cannot disagree again; a second fix to one render would have re-opened the drift this closes