security(ui): harden rendered filenames against BiDi controls

[seonghobae]

Scope correction

이 PR에서 확인되는 실제 경계는 정적 directory listing에 표시되는 공격자 제어 파일명/디렉토리명의 시각적 순서 왜곡입니다. html4tree에는 파일 업로드·실행 기능이 없으므로 generated body의 “악성 파일 업로드/실행” 영향은 repository evidence로 입증되지 않습니다.

Unicode 18.0 UAX #9(2026-09-01)는 Bidi_Control에 ALM/LRM/RLM, embedding·override controls, isolate controls를 포함합니다. WHATWG HTML은 방향을 알 수 없는 외부 텍스트를 주변 문맥과 격리할 때 bdi를 사용하도록 정의합니다.

Primary references:

• https://www.unicode.org/reports/tr9/
• https://html.spec.whatwg.org/multipage/text-level-semantics.html#the-bdi-element

Current causal repair

• protected base: master@728f0f33323e43573d6664209891099502827d5d
• RED fixture commit: daba942d536029f598bb2599e717457751548ab5
• production fix: fea5a94db3cd3ccbf8a23baa8d143b648223823e
• exact head: 1e7c1af8bd48da4b5872dca451b8a3613450de3c
• ordinary non-force descendants only

escapeHtml() now neutralizes the complete 12-character Unicode Bidi_Control set as visible \uXXXX text while urlEncodePath() continues to encode the original filename bytes for href. Generated file labels use <bdi dir="auto"> rather than attacker-controlled directional formatting characters. Tooltip/title text receives the neutralized filename. The existing trusted FSI/PDI wrappers around the directory heading/title remain unchanged in this lineage; attacker-provided controls inside the directory name are neutralized before that boundary.

The focused regression covers ALM, LRM, RLM, LRE, RLE, PDF, LRO, RLO, LRI, RLI, FSI and PDI, natural Arabic/Korean text, encoded href preservation, tooltip text, and filename markup isolation.

Generated .jules/sentinel.md doctrine remains outside this effective repair; no force push, destructive rebase, self-approval or gate weakening was used.

Remaining acceptance before Ready

• exact-head CI/JaCoCo/Security/SAST/CodeQL terminal GREEN
• unresolved review thread 0 and qualifying independent review
• current-head browser DOM/screenshot/accessibility-tree evidence for ordinary LTR/RTL filenames and malicious control fixtures
• keyboard/focus and responsive checks on the generated directory listing
• copy/paste semantics confirmation for the visible filename label

Current hosted status is nonterminal, so this PR remains Draft and no merge/release claim is made.

Material UI Delivery Gate

• 의도성: PASS — filename display-integrity 경계와 위협 범위가 명확함
• 콘텐츠 적합성: PASS — 실제 directory-listing 기능에 직접 필요한 hardening임
• 기능 완전성: PARTIAL — source-level 전체 Bidi_Control 계약과 focused regression은 갖췄으나 browser acceptance 미완료
• 복원력: PARTIAL — natural RTL/LTR unit contract는 추가했지만 browser/a11y/copy-paste/responsive evidence가 아직 없음
• 증거성: FAIL — exact-head hosted gates와 independent review가 terminal하지 않음
• 고유성: N/A — 기존 제품 UI hardening 범위

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}