fix: allow emoji ZWJ sequences in unicode-abuse security scanner (#18793)

Author: Copilot

pkg/workflow/markdown_security_scanner.go

@@ -212,6 +212,20 @@ var bidiOverrideRunes = map[rune]string{
 	'\u2069': "pop directional isolate (U+2069)",
 }
 
+// isEmojiLike reports whether r is in a Unicode range commonly used for emoji.
+// This is used to distinguish legitimate emoji ZWJ sequences (e.g., 🧑‍🤝‍🧑)
+// from abusive uses of U+200D to hide or obfuscate ASCII text.
+//
+// Ranges covered:
+//   - U+2194–U+27BF: arrows, misc symbols, and dingbats (includes ❤ U+2764, ♀ U+2640)
+//   - U+FE00–U+FE0F: variation selectors (e.g., U+FE0F forces emoji presentation)
+//   - U+1F000+:      supplementary multilingual plane where most modern emoji live
+func isEmojiLike(r rune) bool {
+	return (r >= 0x2194 && r <= 0x27BF) || // arrows, misc symbols, dingbats
+		(r >= 0xFE00 && r <= 0xFE0F) || // variation selectors
+		r >= 0x1F000 // supplementary multilingual plane (most modern emoji)
+}
+
 func scanUnicodeAbuse(content string) []SecurityFinding {
 	var findings []SecurityFinding
 	lines := strings.Split(content, "\n")
@@ -222,6 +236,7 @@ func scanUnicodeAbuse(content string) []SecurityFinding {
 		lineNo := lineNum + 1
 
 		// Check for zero-width and invisible characters
+		var prevRune rune
 		for i := 0; i < len(line); {
 			r, size := utf8.DecodeRuneInString(line[i:])
 			if r == utf8.RuneError && size <= 1 {
@@ -230,6 +245,22 @@ func scanUnicodeAbuse(content string) []SecurityFinding {
 			}
 
 			if name, ok := dangerousUnicodeRunes[r]; ok {
+				// U+200D (ZWJ) is a standard component of emoji sequences such as
+				// 🧑‍🤝‍🧑 (people holding hands) or 👨‍👩‍👧 (family). Only flag it when
+				// it is NOT flanked by emoji-range codepoints on both sides.
+				// prevRune is 0 (null) at the start of each line, so a ZWJ at
+				// the beginning of a line is always flagged (isEmojiLike(0)==false).
+				if r == '\u200D' {
+					var nextRune rune
+					if i+size < len(line) {
+						nextRune, _ = utf8.DecodeRuneInString(line[i+size:])
+					}
+					if isEmojiLike(prevRune) && isEmojiLike(nextRune) {
+						prevRune = r
+						i += size
+						continue
+					}
+				}
 				findings = append(findings, SecurityFinding{
 					Category:    CategoryUnicodeAbuse,
 					Description: "contains invisible character: " + name,
@@ -260,6 +291,7 @@ func scanUnicodeAbuse(content string) []SecurityFinding {
 				}
 			}
 
+			prevRune = r
 			i += size
 		}
 	}

pkg/workflow/markdown_security_scanner_test.go

@@ -115,7 +115,70 @@ func TestScanMarkdownSecurity_UnicodeAbuse_AllowsNormalWhitespace(t *testing.T)
 	assert.Empty(t, findings, "should not flag normal whitespace characters")
 }
 
-// --- Hidden Content Tests ---
+func TestScanMarkdownSecurity_UnicodeAbuse_AllowsEmojiZWJ(t *testing.T) {
+	// ZWJ (U+200D) is legitimate between emoji codepoints and must not be flagged.
+	tests := []struct {
+		name    string
+		content string
+	}{
+		{
+			name:    "people holding hands (issue report example)",
+			content: "Status: \U0001F9D1\u200D\U0001F91D\u200D\U0001F9D1 Team Triage",
+		},
+		{
+			name:    "family emoji",
+			content: "Group: \U0001F468\u200D\U0001F469\u200D\U0001F467",
+		},
+		{
+			name:    "woman technologist",
+			content: "Role: \U0001F469\u200D\U0001F4BB",
+		},
+		{
+			name:    "rainbow flag (variation selector before ZWJ)",
+			content: "Flag: \U0001F3F3\uFE0F\u200D\U0001F308",
+		},
+		{
+			name:    "couple with heart (symbol-range emoji before ZWJ)",
+			content: "Love: \U0001F468\u200D\u2764\uFE0F\u200D\U0001F469",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			findings := ScanMarkdownSecurity(tt.content)
+			assert.Empty(t, findings, "should not flag emoji ZWJ sequence in %s", tt.name)
+		})
+	}
+}
+
+func TestScanMarkdownSecurity_UnicodeAbuse_FlagsNonEmojiZWJ(t *testing.T) {
+	// ZWJ between non-emoji (ASCII) characters is still suspicious and must be flagged.
+	tests := []struct {
+		name    string
+		content string
+	}{
+		{
+			name:    "ZWJ between ASCII letters",
+			content: "Hello\u200Dworld",
+		},
+		{
+			name:    "ZWJ at start of text",
+			content: "\u200DHello",
+		},
+		{
+			name:    "ZWJ at end of line",
+			content: "Hello\u200D",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			findings := ScanMarkdownSecurity(tt.content)
+			require.NotEmpty(t, findings, "should flag ZWJ outside emoji sequence in %s", tt.name)
+			assert.Equal(t, CategoryUnicodeAbuse, findings[0].Category, "category should be unicode-abuse")
+		})
+	}
+}
 
 func TestScanMarkdownSecurity_HiddenContent_SuspiciousHTMLComments(t *testing.T) {
 	tests := []struct {