> Due to missing character encoding in the progress display, the object name can be used to manipulate the client output, for example to employ ANSI codes to hide additional files being transferred.
The server description could be a subset of objects it writes to local.
Ok. For that, I think it would be apt for scp to somehow quote the filename when it contains a non-printable character, escaping the non-printable characters, thereby avoiding their interpretation as ANSI codes.
The server description could be a subset of objects it writes to local.