fix: close @mention neutralization bypass via U+200E/200F/00AD/034F invisible chars (#23735)

Author: Copilot

actions/setup/js/sanitize_content.test.cjs

@@ -1488,6 +1488,57 @@ describe("sanitize_content.cjs", () => {
         const expected = "";
         expect(sanitizeContent(input)).toBe(expected);
       });
+
+      it("should remove left-to-right mark (U+200E)", () => {
+        const input = "Hello\u200EWorld";
+        const expected = "HelloWorld";
+        expect(sanitizeContent(input)).toBe(expected);
+      });
+
+      it("should remove right-to-left mark (U+200F)", () => {
+        const input = "Hello\u200FWorld";
+        const expected = "HelloWorld";
+        expect(sanitizeContent(input)).toBe(expected);
+      });
+
+      it("should remove soft hyphen (U+00AD)", () => {
+        const input = "Hello\u00ADWorld";
+        const expected = "HelloWorld";
+        expect(sanitizeContent(input)).toBe(expected);
+      });
+
+      it("should remove combining grapheme joiner (U+034F)", () => {
+        const input = "Hello\u034FWorld";
+        const expected = "HelloWorld";
+        expect(sanitizeContent(input)).toBe(expected);
+      });
+    });
+
+    describe("@mention bypass prevention via invisible characters", () => {
+      it("should neutralize @mention with U+200F (RTL mark) inserted between @ and username", () => {
+        const input = "@\u200Fadmin please review";
+        expect(sanitizeContent(input)).toBe("`@admin` please review");
+      });
+
+      it("should neutralize @mention with U+200E (LTR mark) inserted between @ and username", () => {
+        const input = "@\u200Eadmin please review";
+        expect(sanitizeContent(input)).toBe("`@admin` please review");
+      });
+
+      it("should neutralize @mention with U+00AD (soft hyphen) inserted between @ and username", () => {
+        const input = "@\u00ADadmin please review";
+        expect(sanitizeContent(input)).toBe("`@admin` please review");
+      });
+
+      it("should neutralize @mention with U+034F (combining grapheme joiner) inserted between @ and username", () => {
+        const input = "@\u034Fadmin please review";
+        expect(sanitizeContent(input)).toBe("`@admin` please review");
+      });
+
+      it("should neutralize @mention with multiple invisible chars inserted between @ and username", () => {
+        const input = "ping @\u200E\u200F\u00AD\u034Fadmin now";
+        expect(sanitizeContent(input)).toBe("ping `@admin` now");
+      });
     });
 
     describe("Unicode normalization (NFC)", () => {

actions/setup/js/sanitize_content_core.cjs

@@ -931,8 +931,10 @@ function hardenUnicodeText(text) {
 
   // Step 3: Strip invisible zero-width characters that can hide content
   // These include: zero-width space, zero-width non-joiner, zero-width joiner,
+  // left-to-right mark (U+200E), right-to-left mark (U+200F),
+  // soft hyphen (U+00AD), combining grapheme joiner (U+034F),
   // word joiner, and byte order mark
-  result = result.replace(/[\u200B\u200C\u200D\u2060\uFEFF]/g, "");
+  result = result.replace(/[\u00AD\u034F\u200B\u200C\u200D\u200E\u200F\u2060\uFEFF]/g, "");
 
   // Step 4: Remove bidirectional text override controls
   // These can be used to reverse text direction and create visual spoofs

actions/setup/js/sanitize_label_content.test.cjs

@@ -116,6 +116,32 @@ describe("sanitize_label_content.cjs", () => {
       expect(sanitizeLabelContent(maliciousLabel)).toBe("bug");
     });
 
+    it("should remove left-to-right mark (U+200E) and right-to-left mark (U+200F)", () => {
+      expect(sanitizeLabelContent("bug\u200Elabel")).toBe("buglabel");
+      expect(sanitizeLabelContent("bug\u200Flabel")).toBe("buglabel");
+    });
+
+    it("should remove soft hyphen (U+00AD) and combining grapheme joiner (U+034F)", () => {
+      expect(sanitizeLabelContent("bug\u00ADlabel")).toBe("buglabel");
+      expect(sanitizeLabelContent("bug\u034Flabel")).toBe("buglabel");
+    });
+
+    it("should neutralize @mention with U+200F (RTL mark) between @ and username", () => {
+      expect(sanitizeLabelContent("@\u200Fadmin")).toBe("`@admin`");
+    });
+
+    it("should neutralize @mention with U+200E (LTR mark) between @ and username", () => {
+      expect(sanitizeLabelContent("@\u200Eadmin")).toBe("`@admin`");
+    });
+
+    it("should neutralize @mention with U+00AD (soft hyphen) between @ and username", () => {
+      expect(sanitizeLabelContent("@\u00ADadmin")).toBe("`@admin`");
+    });
+
+    it("should neutralize @mention with U+034F (combining grapheme joiner) between @ and username", () => {
+      expect(sanitizeLabelContent("@\u034Fadmin")).toBe("`@admin`");
+    });
+
     it("should preserve emoji in labels", () => {
       expect(sanitizeLabelContent("🐛 bug")).toBe("🐛 bug");
       expect(sanitizeLabelContent("✨ enhancement")).toBe("✨ enhancement");