Merge pull request 'Extend message sanitization to scrub unusual whitespace' (#88) from toes/netfishing:fix/untrimmed-unicode-whitespace into main

network/network_chat_protocol.gd

@@ -9,6 +9,13 @@ const MAX_HISTORY: int = 100
 const LATE_JOIN_HISTORY: int = 50
 const MAX_ID_LENGTH: int = 96
 
+static var _invisible_edge_pattern: RegEx = RegEx.create_from_string(
+	"^[\\s\\p{Z}\\p{Cf}\\x{2800}]+|[\\s\\p{Z}\\p{Cf}\\x{2800}]+$"
+)
+static var _visible_content_pattern: RegEx = RegEx.create_from_string(
+	"[^\\s\\p{Z}\\p{Cf}\\x{2800}]"
+)
+
 enum Kind { PLAYER, SYSTEM }
 
 
@@ -16,8 +23,13 @@ static func sanitize_body(value: Variant) -> String:
 	if typeof(value) != TYPE_STRING:
 		return ""
 	var result: String = str(value).replace("\r", " ").replace("\n", " ")
-	result = result.replace("\t", " ").strip_edges()
-	if result.is_empty() or result.length() > MAX_VISIBLE_CHARACTERS:
+	result = result.replace("\t", " ")
+	result = _invisible_edge_pattern.sub(result, "", true)
+	if (
+		result.is_empty()
+		or _visible_content_pattern.search(result) == null
+		or result.length() > MAX_VISIBLE_CHARACTERS
+	):
 		return ""
 	if result.to_utf8_buffer().size() > MAX_UTF8_BYTES:
 		return ""

scripts/run_validations.sh

@@ -15,6 +15,7 @@ readonly -a QUICK_TESTS=(
 	"tests/android_readiness_validation.gd"
 	"tests/camera_drag_validation.gd"
 	"tests/character_rig_validation.gd"
+	"tests/chat_validation.gd"
 	"tests/controller_focus_presentation_validation.gd"
 	"tests/controller_menu_accessibility_validation.gd"
 	"tests/controller_mapping_validation.gd"

tests/chat_validation.gd

@@ -0,0 +1,38 @@
+extends SceneTree
+
+func _initialize() -> void:
+	call_deferred("_run")
+
+
+func _run() -> void:
+	assert(NetworkChatProtocol.sanitize_body(42).is_empty())
+	assert(NetworkChatProtocol.sanitize_body("   a   ") == "a")
+	assert(NetworkChatProtocol.sanitize_body("a b") == "a b")
+	assert(NetworkChatProtocol.sanitize_body("a\tb\nc") == "a b c")
+	assert(NetworkChatProtocol.sanitize_body(" !hello!? ") == "!hello!?")
+	assert(NetworkChatProtocol.sanitize_body("!!!") == "!!!")
+
+	const em_space := " " # U+2003 EM SPACE
+	const zero_width_space := "​" # U+200B ZERO WIDTH SPACE
+	const braille_blank := "⠀" # U+2800 BRAILLE PATTERN BLANK
+	const invisible_padding := em_space + zero_width_space + braille_blank
+	assert(
+		NetworkChatProtocol.sanitize_body(invisible_padding + "a" + invisible_padding)
+		== "a"
+	)
+	assert(NetworkChatProtocol.sanitize_body(invisible_padding).is_empty())
+	assert(NetworkChatProtocol.sanitize_body(" \t\n" + invisible_padding).is_empty())
+
+	assert(
+		NetworkChatProtocol.sanitize_body("a".repeat(
+			NetworkChatProtocol.MAX_VISIBLE_CHARACTERS
+		)).length() == NetworkChatProtocol.MAX_VISIBLE_CHARACTERS
+	)
+	assert(
+		NetworkChatProtocol.sanitize_body("a".repeat(
+			NetworkChatProtocol.MAX_VISIBLE_CHARACTERS + 1
+		)).is_empty()
+	)
+
+	print("Chat validation: PASS")
+	quit(0)

tests/chat_validation.gd.uid

@@ -0,0 +1 @@
+uid://ohemhv2sf5g4

ui/chat_ui.gd

@@ -893,14 +893,14 @@ func _on_entry_text_submitted(_value: String) -> void:
 func _send() -> void:
 	if _send_pending:
 		return
-	var body := _entry.text
-	if body.strip_edges().is_empty():
+	var body := NetworkChatProtocol.sanitize_body(_entry.text)
+	if body.is_empty():
 		close_chat()
 		return
 	if _handle_editor_world_command(body):
 		return
 	_send_pending = true
-	_pending_send_body = NetworkChatProtocol.sanitize_body(body)
+	_pending_send_body = body
 	_entry.editable = false
 	if not _service.send_local_message(
 		body,