sanitize compiler output more (#1430)

notably, this removes null bytes from compiler output, should they end
up there. this is necessary because postgres doesn't allow storing null
bytes in text columns, so ES would previously error when trying to store
the compilation output in the DB. (additionally, it's a bit nicer to the
contestants, as control characters aren't rendered in an useful way by
browsers anyways.)

Author: prandla

cms/grading/steps/stats.py

@@ -25,6 +25,7 @@
 
 """Computing and merging statistics about command executions in the sandbox."""
 
+import re
 from cms.grading.Sandbox import Sandbox
 import typing
 
@@ -63,10 +64,14 @@ def execution_stats(sandbox: Sandbox, collect_output: bool = False) -> StatsDict
         stats["signal"] = sandbox.get_killing_signal()
 
     if collect_output:
-        stats["stdout"] = sandbox.get_file_to_string(sandbox.stdout_file)\
-            .decode("utf-8", errors="replace").strip()
-        stats["stderr"] = sandbox.get_file_to_string(sandbox.stderr_file)\
-            .decode("utf-8", errors="replace").strip()
+        def safe_get_str(filename: str) -> str:
+            s = sandbox.get_file_to_string(filename)
+            s = s.decode("utf-8", errors="replace")
+            s = re.sub('[\x00-\x08\x0b\x0c\x0e-\x1f\x7f-\xbf]', '\ufffd', s)
+            s = s.strip()
+            return s
+        stats["stdout"] = safe_get_str(sandbox.stdout_file)
+        stats["stderr"] = safe_get_str(sandbox.stderr_file)
 
     return stats