security(html): neutralize bidi controls at the display boundary

[seonghobae]

Buyer-visible security boundary

A filename containing Unicode bidirectional formatting controls must not visually hide its real extension in the generated directory listing. The real filesystem name must still be used for the link target.

This clean current-master replacement avoids #454's global escapeHtml() stripping, which mixes HTML escaping with filename trust policy and can delete renderer-owned bidi isolation marks. It also avoids importing the unrelated size/mtime and other product changes from closed #463.

Test-first state

RED head c7d89cc8e123a03eebc29cdb48f7cb14701327de adds generated-page regressions before production changes. They require:

• U+061C, U+200E/U+200F, U+202A–U+202E, and U+2066–U+2069 to be classified as filename display controls;
• display-only U+FFFD replacement while ordinary text remains unchanged;
• renderer-owned FSI/PDI marks to survive HTML escaping;
• a generated listing to show the neutralized name while retaining the exact encoded real filename in href;
• a generated page heading/title to neutralize controls as well.

The RED head is intentionally not merge-ready because the production functions and rendering boundary do not exist yet.

Scope

Base: master@de82f99f66fc9e190398f9bb1c8c6bd69bd88a30.

No Storybook or Figma integration exists in this static Kotlin-generated HTML product, and this slice changes the security rendering contract rather than layout or visual design. Existing CSS and translatable hidden type labels remain owned by the current base.

Supersedes #454 after this replacement proves current-head CI/security/review evidence.

Merge contract

Keep Draft until the unchanged exact head has repository tests/coverage/security gates and all live central required workflows terminal-success, zero actionable current-head review findings, and a qualifying independent non-author approval. Do not bypass protection or treat skipped/predecessor evidence as passing.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}