ContextualWisdomLab · seonghobae · Sep 23, 2026 · Sep 23, 2026 · Sep 24, 2026 · Sep 24, 2026
diff --git a/.jules/sentinel.md b/.jules/sentinel.md
@@ -99,3 +99,8 @@
 **Root cause:** The protected implementation added canonical names to the exclusion set but did not compare each observed directory entry through a locale-stable normalized key.
 **Prevention:** Build one `Locale.ROOT` lowercase set from the canonical sensitive names, compare every observed name against it, and add the original spelling to the exclusion set so downstream exact membership remains correct.
 **Evidence:** `testProcessIgnoreFileTreatsSensitiveNamesCaseInsensitively` failed on test-only commit `472b916cd40f70693c4e1eb48956042a25353feb` (CI run `31469596932`) and passed with the source fix at `bb113d858ccfc42ddaecf6729749b238e5ade2d0` (CI run `31469921661`).
+
+## 2024-05-31 - [HIGH] Prevent BiDi Spoofing and Information Concealment
+**Vulnerability:** Bidirectional (BiDi) control characters can spoof filenames or extensions (e.g. `\u202E`).
+**Learning:** Exposing them visually prevents malicious spoofing. Wrap user-input variables with `&#x2068;` and `&#x2069;` in HTML contexts.
+**Prevention:** Escape BiDi chars deterministically, wrap uncontrolled HTML with FSI and PDI entities.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -19,6 +19,8 @@ All notable changes to this project are documented in this file.
 
 ### Fixed
 
+- 양방향(BiDi) 제어 문자를 통한 파일 이름 및 확장자 스푸핑 방지를 위해, 해당 문자를 이스케이프 처리하고 생성되는 HTML에 FSI(`&#x2068;`) 및 PDI(`&#x2069;`) 태그를 적용하여 입력값을 안전하게 격리하도록 수정했습니다.
+
 - Generate the inline-style Content Security Policy SHA-256 source expression
   from the exact normalized UTF-8 stylesheet bytes emitted into each generated
   `index.html` file, preventing template whitespace from invalidating the policy.

diff --git a/src/main/kotlin/html4tree/main.kt b/src/main/kotlin/html4tree/main.kt
@@ -243,6 +243,9 @@ fun String.escapeHtml(): String {
             '"' -> "&quot;"
             '\'' -> "&#x27;"
             '`' -> "&#x60;"
+            '\u202E' -> "\\u202E"
+            '\u2068' -> "\\u2068"
+            '\u2069' -> "\\u2069"
             else -> null
         }
         if (replacement != null) {
@@ -421,12 +424,12 @@ fun process_dir(curr_dir: File, excludeSet: Set<String>? = null, dirFiles: Array
         <!-- 보안 향상: 리퍼러를 통한 디렉토리 경로 노출 방지 -->
         <meta name="referrer" content="no-referrer">
         <meta name="robots" content="noindex, nofollow">
-        <title>${directoryName.escapeHtml()} - 디렉토리 목록</title>
+        <title>&#x2068;${directoryName.escapeHtml()}&#x2069; - 디렉토리 목록</title>
         <style>${CSS_CONTENT}</style>
      </head>
      <body>
        <main>
-         <h1>${directoryName.escapeHtml()}</h1>
+         <h1>&#x2068;${directoryName.escapeHtml()}&#x2069;</h1>
          <nav aria-label="디렉토리 목록">
          <ul role="list">
             <li><a class="dir-link" href="./.." title="상위 디렉토리로 이동"><span class="icon" aria-hidden="true">&#x21B0;</span> <span aria-hidden="true">..</span> <span class="visually-hidden">상위 디렉토리로 이동</span></a></li>
@@ -457,10 +460,10 @@ fun process_dir(curr_dir: File, excludeSet: Set<String>? = null, dirFiles: Array
                }
                if (!isSymbolicLink) {
                   val encodedHref = if (isLinkedDirectory) { "./${fileName.urlEncodePath()}/" } else { "./${fileName.urlEncodePath()}" }
-                  val ariaLabel = "${fileName} ${if (isLinkedDirectory) { "디렉토리" } else { "파일" }}".escapeHtml()
+                  val ariaLabel = "&#x2068;${fileName.escapeHtml()}&#x2069; ${if (isLinkedDirectory) { "디렉토리" } else { "파일" }}"
                   val typeLabel = if (isLinkedDirectory) { "디렉토리" } else { "파일" }
                   val icon = if (isLinkedDirectory) { "&#128193;" } else { "&#128196;" }
-                  l.append("""          <li><a class="dir-link" href="${encodedHref}" title="${ariaLabel}"><span class="icon" aria-hidden="true">${icon}</span> <span>${fileName.escapeHtml()}</span> <span class="visually-hidden">${typeLabel}</span></a></li>""")
+                  l.append("""          <li><a class="dir-link" href="${encodedHref}" title="${ariaLabel}"><span class="icon" aria-hidden="true">${icon}</span> <span>&#x2068;${fileName.escapeHtml()}&#x2069;</span> <span class="visually-hidden">${typeLabel}</span></a></li>""")
                   l.append('\n')
                }
            }

diff --git a/src/test/kotlin/html4tree/MainTest.kt b/src/test/kotlin/html4tree/MainTest.kt
@@ -106,6 +106,14 @@ class MainTest {
         }
     }
 
+    @Test
+    fun testEscapeHtmlWithBiDiControlCharacters() {
+        val bidiInput = "\u202Etest\u2068file\u2069.txt"
+        val escaped = bidiInput.escapeHtml()
+        assertEquals("\\u202Etest\\u2068file\\u2069.txt", escaped)
+    }
+
+
     @Test
     fun testGoEmptyDir() {
         go(tempDir.absolutePath, -1)
@@ -339,11 +347,11 @@ class MainTest {
         assertTrue(htmlContent.contains("title=\"상위 디렉토리로 이동\""))
         assertTrue(htmlContent.contains("aria-hidden=\"true\""))
         assertTrue(htmlContent.contains("<span class=\"visually-hidden\">파일</span>"))
-        assertTrue(htmlContent.contains("title=\"file1.txt 파일\""))
+        assertTrue(htmlContent.contains("title=\"&#x2068;file1.txt&#x2069; 파일\""))
         assertTrue(htmlContent.contains("<span class=\"visually-hidden\">디렉토리</span>"))
-        assertTrue(htmlContent.contains("title=\"subdir 디렉토리\""))
-        assertTrue(htmlContent.contains("file1.txt"))
-        assertTrue(htmlContent.contains("subdir/"))
+        assertTrue(htmlContent.contains("title=\"&#x2068;subdir&#x2069; 디렉토리\""))
+        assertTrue(htmlContent.contains("&#x2068;file1.txt&#x2069;"))
+        assertTrue(htmlContent.contains("&#x2068;subdir&#x2069;"))
         assertTrue(htmlContent.contains("&#128193;"))
         assertFalse(htmlContent.contains("test.ignore"))
         assertTrue(htmlContent.contains("Content-Security-Policy"))
@@ -942,8 +950,8 @@ class MainTest {
         val indexHtml = File(fakeRoot, "index.html")
         assertTrue(indexHtml.exists())
         val content = indexHtml.readText()
-        assertTrue(content.contains("<title>Root - 디렉토리 목록</title>"))
-        assertTrue(content.contains("<h1>Root</h1>"))
+        assertTrue(content.contains("<title>&#x2068;Root&#x2069; - 디렉토리 목록</title>"))
+        assertTrue(content.contains("<h1>&#x2068;Root&#x2069;</h1>"))
     }
 
 }