charater in display name affecting adjacent text

[adbenitez]

copied text from a message in the picture:

Evil Rabbit‮ scored 977 in Tetris

the user has the display name set to Evil Rabbit‮ (an special character U+202E is at the end that cause all subsequent text to be reverted)

Maybe core should trim/strip display names and remove the characters, but I think not even removing from the end will help, and if removed from any position might actually affect some name in some language? maybe there is some special character to limit/set boundaries of this character

[r10s]

thanks for filing the issue, i roughtly remember some things now :)

i also think, removing only at the end does not help.

we could make sure that an even number of U+202E is used, but that would still not solve the issue when real names are to be blurred - iirc this was an attack for file extensions at some point (eg. an exe named file.exe.pdf that in reality has the extension .pdf - this would probably work for us as well. (found an even worse example at https://github.com/microsoft/terminal/issues/2409: harmless_file[U+202E]fdp.bat would render as harmless_filetab.pdf

so, the "name" field is probably not even the worst place where this character could do confusion or maybe harm.

some options:

1. ignoring the issue (as probably some other apps do, k-9 was mentioned)

2. remove U+202E characters completely everywhere, that probably has unwanted side effects: eg. if we would start removing the characters from "full messages" (otherwise one could argue ppl will trick with links, file extensions etc.), you cannot have an arabic name or cite in an otherwise latin document. or the other way round.
   EDIT: maybe the side effect is far less: iirc eg. arabic is rtl automatically by definition of the used characters

3. only remove U+202E in the display name completely, that would close this issue, however, leave the issue open for "full message" views. maybe okay.
   esp. 3. would avoid system messages being messed up.
   we should do the removal also for group names and file names. we could also not just silently remove but replace by some string to make the evil ppl more visible ;)

nice overview about this stuff, with xkcd comics, https://unicode-explorer.com/c/202E

EDIT: according to https://stackoverflow.com/questions/41487035/handling-right-to-left-left-to-right-override-characters-in-user-input "real Arabic/Hebrew/etc keyboards can't type BiDi control characters" so they very likely come from malicious input, so removing them seems to be a viable option. would be interesting what other apps do on this issue ...