Cleanup unicode chars #5

New issue

Closed

opened 2026-07-16 04:07:47 +00:00 by alex · 2 comments

alex commented

2026-07-16 04:07:47 +00:00

Owner

Renovate report:

⚠️ WARN: Hidden Unicode characters have been discovered in file(s) in your repository. See your Renovate logs for more details. Please confirm that they are intended to be there, as they could be an attempt to "smuggle" text into your codebase, or used to confuse tools like Renovate or Large Language Models (LLMs)

Renovate report: ⚠️ WARN: Hidden Unicode characters have been discovered in file(s) in your repository. See your Renovate logs for more details. Please confirm that they are intended to be there, as they could be an attempt to "smuggle" text into your codebase, or used to confuse tools like Renovate or Large Language Models (LLMs)

alex commented

2026-07-16 04:07:52 +00:00

Author

Owner

/pi new PR

pi referenced this issue from a pull request that will close it,

2026-07-16 04:13:25 +00:00

fix: strip hidden Unicode (U+200B) from build output #6

pi commented

2026-07-16 04:13:48 +00:00

Contributor

I found the issue. There's exactly one hidden Unicode character — a zero-width space (U+200B) — in dist/index.html, inside a CSS rule that comes from the @picocss/pico library:

:where(nav li):before{float:left;content:""}  ← U+200B inside the quotes

Since dist/index.html is a committed build artifact that CI rebuilds on every push to master, simply editing the file would let the character come back on the next rebuild. I need to fix it at the build step so the regenerated bundle is clean. Let me verify how bun handles build lifecycle hooks before wiring a fix.Both npm and bun respect the postbuild lifecycle hook, and node is universally available. Now let me implement the fix.

I'll create a small post-build script that strips hidden Unicode from the bundle, wire it into the build, and clean up the already-committed dist/index.html.Now wire it into the build via a postbuild hook:Now run the sanitizer on the already-committed dist/index.html so the committed artifact is clean too:Scan is now clean (grep exit 1 = no matches). Let me verify the replacement is valid CSS and confirm the diff:The zero-width space is now replaced with the valid CSS escape \200B. Let me confirm the sanitizer is idempotent (no-op on already-clean output) and that the script file is tracked:Everything is in place. Let me create the PR.PR created: #6

What I found: The only hidden Unicode character flagged by Renovate was a zero-width space (U+200B) in dist/index.html, injected by the @picocss/pico framework inside the CSS rule :where(nav li):before{float:left;content:""}.

Why a build-step fix (not just a file edit): dist/index.html is a committed build artifact that CI rebuilds on every push to master, so editing it alone would let the character return. The fix adds a postbuild sanitizer (scripts/strip-invisible.mjs) that replaces the U+200B byte with its semantically-identical CSS escape \200B, guaranteeing clean output on every rebuild — and I also cleaned the already-committed dist/index.html. All tracked files now scan clean for invisible/bidi Unicode, and the sanitizer is idempotent.

I found the issue. There's exactly one hidden Unicode character — a **zero-width space (U+200B)** — in `dist/index.html`, inside a CSS rule that comes from the `@picocss/pico` library: ```css :where(nav li):before{float:left;content:""} ← U+200B inside the quotes ``` Since `dist/index.html` is a committed build artifact that CI rebuilds on every push to `master`, simply editing the file would let the character come back on the next rebuild. I need to fix it at the build step so the regenerated bundle is clean. Let me verify how bun handles build lifecycle hooks before wiring a fix.Both npm and bun respect the `postbuild` lifecycle hook, and `node` is universally available. Now let me implement the fix. I'll create a small post-build script that strips hidden Unicode from the bundle, wire it into the build, and clean up the already-committed `dist/index.html`.Now wire it into the build via a `postbuild` hook:Now run the sanitizer on the already-committed `dist/index.html` so the committed artifact is clean too:Scan is now clean (grep exit 1 = no matches). Let me verify the replacement is valid CSS and confirm the diff:The zero-width space is now replaced with the valid CSS escape `\200B`. Let me confirm the sanitizer is idempotent (no-op on already-clean output) and that the script file is tracked:Everything is in place. Let me create the PR.PR created: https://forge.l3x.in/alex/opengist-viewer/pulls/6 **What I found:** The only hidden Unicode character flagged by Renovate was a **zero-width space (U+200B)** in `dist/index.html`, injected by the `@picocss/pico` framework inside the CSS rule `:where(nav li):before{float:left;content:""}`. **Why a build-step fix (not just a file edit):** `dist/index.html` is a committed build artifact that CI rebuilds on every push to `master`, so editing it alone would let the character return. The fix adds a `postbuild` sanitizer (`scripts/strip-invisible.mjs`) that replaces the U+200B byte with its semantically-identical CSS escape `\200B`, guaranteeing clean output on every rebuild — and I also cleaned the already-committed `dist/index.html`. All tracked files now scan clean for invisible/bidi Unicode, and the sanitizer is idempotent. --- [View action run](https://forge.l3x.in/alex/opengist-viewer/actions/runs/22) | Model: zai/glm-5.2 (thinking: max) | Time: 5m 47s | Tokens: 571.8K | Pi SDK v0.80.7 | Action v2.25.1-develop (develop @ e069697)

alex closed this issue

2026-07-16 04:17:29 +00:00

No labels

dependencies

No milestone

No assignees

2 participants

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

alex/opengist-viewer#5

No description provided.

Rows
Columns