fix: strip Unicode bidi control characters from user content (#226)

- Add stripUserContent() function to remove HTML and bidi controls
- Remove U+202A-U+202E (LRE, RLE, PDF, LRO, RLO) characters
- Remove U+2066-U+2069 (LRI, RLI, FSI, PDI) characters
- Preserve all printable Unicode, emoji, and ZWJ sequences
- Add 26 comprehensive tests covering bidi removal and content preservation
- Fix adversarial content vulnerability that breaks UI trust

Author: nanaabdul1172

Backend/src/common/utils/sanitize.spec.ts

@@ -1,4 +1,4 @@
-import { stripHtml } from './sanitize';
+import { stripHtml, stripUserContent } from './sanitize';
 
 describe('stripHtml', () => {
   it('should strip HTML tags and script content', () => {
@@ -82,3 +82,202 @@ describe('stripHtml', () => {
     }
   });
 });
+
+describe('stripUserContent', () => {
+  // Bidi control character removal tests
+  describe('Unicode bidi control character removal', () => {
+    it('should remove U+202E (RLO - Right-to-Left Override)', () => {
+      const input = 'hello\u202Egnignignignignignignignignignignigni';
+      const output = stripUserContent(input);
+      expect(output).toBe('hellognignignignignignignignignignignigni');
+      expect(output).not.toContain('\u202E');
+    });
+
+    it('should remove U+202A (LRE - Left-to-Right Embedding)', () => {
+      const input = 'start\u202Amiddle\u202Cend';
+      const output = stripUserContent(input);
+      expect(output).toBe('startmiddleend');
+      expect(output).not.toContain('\u202A');
+      expect(output).not.toContain('\u202C');
+    });
+
+    it('should remove U+202B (RLE - Right-to-Left Embedding)', () => {
+      const input = 'test\u202Bembedded\u202Ctext';
+      const output = stripUserContent(input);
+      expect(output).toBe('testembeddedtext');
+      expect(output).not.toContain('\u202B');
+    });
+
+    it('should remove U+202C (PDF - Pop Directional Formatting)', () => {
+      const input = 'abc\u202Cdef';
+      const output = stripUserContent(input);
+      expect(output).toBe('abcdef');
+      expect(output).not.toContain('\u202C');
+    });
+
+    it('should remove U+202D (LRO - Left-to-Right Override)', () => {
+      const input = 'text\u202Doverride';
+      const output = stripUserContent(input);
+      expect(output).toBe('textoverride');
+      expect(output).not.toContain('\u202D');
+    });
+
+    it('should remove U+2066 (LRI - Left-to-Right Isolate)', () => {
+      const input = 'before\u2066isolate\u2069after';
+      const output = stripUserContent(input);
+      expect(output).toBe('beforeisolateafter');
+      expect(output).not.toContain('\u2066');
+    });
+
+    it('should remove U+2067 (RLI - Right-to-Left Isolate)', () => {
+      const input = 'start\u2067isolate\u2069end';
+      const output = stripUserContent(input);
+      expect(output).toBe('startisolateend');
+      expect(output).not.toContain('\u2067');
+    });
+
+    it('should remove U+2068 (FSI - First Strong Isolate)', () => {
+      const input = 'text\u2068first\u2069strong';
+      const output = stripUserContent(input);
+      expect(output).toBe('textfirststrong');
+      expect(output).not.toContain('\u2068');
+    });
+
+    it('should remove U+2069 (PDI - Pop Directional Isolate)', () => {
+      const input = 'pop\u2069test';
+      const output = stripUserContent(input);
+      expect(output).toBe('poptest');
+      expect(output).not.toContain('\u2069');
+    });
+
+    it('should remove multiple bidi characters in one string', () => {
+      const input = 'a\u202Ab\u202Bc\u202Cd\u202De\u202Ef\u2066g\u2067h\u2068i\u2069j';
+      const output = stripUserContent(input);
+      expect(output).toBe('abcdefghij');
+      // Verify none of the bidi characters remain
+      expect(output).not.toMatch(/[\u202A-\u202E\u2066-\u2069]/);
+    });
+  });
+
+  // Preservation tests
+  describe('Content preservation', () => {
+    it('should preserve standard emoji', () => {
+      const input = 'Hello 🌍 World 🎉 Test 👍';
+      const output = stripUserContent(input);
+      expect(output).toBe('Hello 🌍 World 🎉 Test 👍');
+    });
+
+    it('should preserve emoji with skin tone modifiers', () => {
+      const input = 'Wave 👋🏾 and thumbs up 👍🏽';
+      const output = stripUserContent(input);
+      expect(output).toBe('Wave 👋🏾 and thumbs up 👍🏽');
+    });
+
+    it('should preserve emoji ZWJ sequences', () => {
+      const input = 'Family 👨‍👩‍👧‍👦 and rainbow flag 🏳️‍🌈';
+      const output = stripUserContent(input);
+      expect(output).toBe('Family 👨‍👩‍👧‍👦 and rainbow flag 🏳️‍🌈');
+    });
+
+    it('should preserve accented characters', () => {
+      const input = 'Café résumé naïve';
+      const output = stripUserContent(input);
+      expect(output).toBe('Café résumé naïve');
+    });
+
+    it('should preserve CJK characters', () => {
+      const input = '日本語 中文 한국어';
+      const output = stripUserContent(input);
+      expect(output).toBe('日本語 中文 한국어');
+    });
+
+    it('should preserve Arabic and Hebrew text', () => {
+      const input = 'مرحبا שלום';
+      const output = stripUserContent(input);
+      expect(output).toBe('مرحبا שלום');
+    });
+
+    it('should preserve mixed Unicode content', () => {
+      const input = 'Test Ẽñõẽd 日本 🌟 café';
+      const output = stripUserContent(input);
+      expect(output).toBe('Test Ẽñõẽd 日本 🌟 café');
+    });
+  });
+
+  // Combined HTML + bidi removal
+  describe('Combined HTML and bidi removal', () => {
+    it('should strip both HTML and bidi characters', () => {
+      const input = '<b>bold\u202Etext</b>';
+      const output = stripUserContent(input);
+      expect(output).toBe('boldtext');
+      expect(output).not.toContain('<');
+      expect(output).not.toContain('\u202E');
+    });
+
+    it('should handle script tags with bidi characters', () => {
+      const input = '<script>alert("xss")</script>safe\u202Etext';
+      const output = stripUserContent(input);
+      expect(output).toBe('safetext');
+      expect(output).not.toContain('alert');
+      expect(output).not.toContain('\u202E');
+    });
+
+    it('should sanitize adversarial content from problem statement', () => {
+      const input = 'hello\u202Egnignignignignignignignignignignigni';
+      const output = stripUserContent(input);
+      expect(output).toBe('hellognignignignignignignignignignignigni');
+      expect(output).not.toContain('\u202E');
+    });
+  });
+
+  // Edge cases
+  describe('Edge cases', () => {
+    it('should handle empty string', () => {
+      expect(stripUserContent('')).toBe('');
+    });
+
+    it('should handle string with only bidi characters', () => {
+      const input = '\u202A\u202B\u202C\u202D\u202E';
+      const output = stripUserContent(input);
+      expect(output).toBe('');
+    });
+
+    it('should handle plain text without bidi or HTML', () => {
+      const input = 'Plain text content';
+      const output = stripUserContent(input);
+      expect(output).toBe('Plain text content');
+    });
+
+    it('should trim whitespace', () => {
+      const input = '  hello\u202Eworld  ';
+      const output = stripUserContent(input);
+      expect(output).toBe('helloworld');
+    });
+  });
+
+  // Regression test: old behavior would have accepted bidi
+  describe('Regression tests', () => {
+    it('should reject bidi characters that old stripHtml would accept', () => {
+      const input = 'test\u202Econtent';
+      // Old behavior: stripHtml would keep bidi characters
+      const oldBehavior = stripHtml(input);
+      expect(oldBehavior).toContain('\u202E'); // Verify old behavior
+      
+      // New behavior: stripUserContent removes them
+      const newBehavior = stripUserContent(input);
+      expect(newBehavior).not.toContain('\u202E');
+      expect(newBehavior).toBe('testcontent');
+    });
+
+    it('should demonstrate bidi vulnerability in old handler', () => {
+      const maliciousInput = 'filename\u202Etxt.exe';
+      
+      // Old stripHtml preserves the bidi character
+      expect(stripHtml(maliciousInput)).toContain('\u202E');
+      
+      // New stripUserContent removes it
+      expect(stripUserContent(maliciousInput)).not.toContain('\u202E');
+      expect(stripUserContent(maliciousInput)).toBe('filenametxt.exe');
+    });
+  });
+});

Backend/src/common/utils/sanitize.ts

@@ -36,3 +36,34 @@ export function stripHtml(input: string): string {
     .replace(/&/g, '&')
     .trim();
 }
+
+/**
+ * Strip user-generated content: removes HTML tags AND Unicode bidi control characters.
+ *
+ * Removes bidirectional text override characters (U+202A–U+202E, U+2066–U+2069)
+ * that can flip display order and break perceived trust in anonymous platforms.
+ *
+ * Preserves:
+ *  - All printable Unicode (including accented characters, CJK, etc.)
+ *  - Emoji and emoji ZWJ sequences
+ *  - Standard whitespace and newlines
+ *
+ * @param input - Raw user content
+ * @returns Sanitized plain text without HTML or bidi controls
+ */
+export function stripUserContent(input: string): string {
+  // First strip HTML
+  const noHtml = stripHtml(input);
+
+  // Remove Unicode bidi control characters:
+  // U+202A (LRE) - Left-to-Right Embedding
+  // U+202B (RLE) - Right-to-Left Embedding
+  // U+202C (PDF) - Pop Directional Formatting
+  // U+202D (LRO) - Left-to-Right Override
+  // U+202E (RLO) - Right-to-Left Override
+  // U+2066 (LRI) - Left-to-Right Isolate
+  // U+2067 (RLI) - Right-to-Left Isolate
+  // U+2068 (FSI) - First Strong Isolate
+  // U+2069 (PDI) - Pop Directional Isolate
+  return noHtml.replace(/[\u202A-\u202E\u2066-\u2069]/g, '');
+}