laantungir/amethyst
1
0
Fork 0
mirror of https://github.com/vitorpamplona/amethyst.git synced 2026-08-08 23:54:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: replace raw bidi/invisible control characters in source with \u escapes

Browse Source 
the files are now pure-ASCII and visually unambiguous:

- BlossomPaymentSafetyTest: raw U+202E/U+202C test payload -> escapes
- BlossomPaymentRequired: BIDI_OVERRIDES char array -> escapes
- Sanitizer: RTL_OVERRIDES and ZERO_WIDTH regex classes -> escapes

Verified by mutation: with BIDI_OVERRIDES stripping disabled,
reasonBidiOverridesAreRemoved fails, proving the escaped payload still
carries a real U+202E. Emoji ZWJ sequences in RichTextParserTest are
intentionally untouched (functional joiners, not bidi controls).
This commit is contained in:
davotoula
2026-07-21 15:04:47 +01:00
parent 72e27a3530
commit 86c8d0b12c
3 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
amethyst/src/test/java/com/vitorpamplona/amethyst/service/uploads/blossom/BlossomPaymentSafetyTest.kt
+3 -3
View File
@@ -215,9 +215,9 @@ class BlossomPaymentSafetyTest {
@Test
fun reasonBidiOverridesAreRemoved() {
val clean = challenge(invoice1000Sats, reason = "fee ‮reversed‬ text").sanitizedReason()!!
assertFalse(clean.contains('‮'))
assertFalse(clean.contains('‬'))
val clean = challenge(invoice1000Sats, reason = "fee \u202Ereversed\u202C text").sanitizedReason()!!
assertFalse(clean.contains('\u202E'))
assertFalse(clean.contains('\u202C'))
}
@Test
commons/src/commonMain/kotlin/com/vitorpamplona/amethyst/commons/moderation/notifications/Sanitizer.kt
+2 -2
View File
@@ -21,8 +21,8 @@
package com.vitorpamplona.amethyst.commons.moderation.notifications
private val CONTROL_CHARS = Regex("\\p{Cntrl}")
private val RTL_OVERRIDES = Regex("[‪-‮⁦-⁩]")
private val ZERO_WIDTH = Regex("[​-‍]")
private val RTL_OVERRIDES = Regex("[\u202A-\u202E\u2066-\u2069]")
private val ZERO_WIDTH = Regex("[\u200B-\u200D\uFEFF]")
private val WHITESPACE = Regex("\\s+")
private val URL_PATTERN = Regex("https?://\\S+")
quartz/src/commonMain/kotlin/com/vitorpamplona/quartz/nipB7Blossom/BlossomPaymentRequired.kt
+1 -1
View File
@@ -74,7 +74,7 @@ data class BlossomPaymentRequired(
const val MAX_REASON_LENGTH = 200
/** LRE/RLE/PDF/LRO/RLO and the isolate family — invisible, and they reorder what follows. */
private val BIDI_OVERRIDES = charArrayOf('‪', '‫', '‬', '‭', '‮', '⁦', '⁧', '⁨', '⁩', '‏', '‎')
private val BIDI_OVERRIDES = charArrayOf('\u202A', '\u202B', '\u202C', '\u202D', '\u202E', '\u2066', '\u2067', '\u2068', '\u2069', '\u200F', '\u200E')
private val WHITESPACE_RUN = Regex("\\s+")