Any dynamically generated text that will be displayed (e.g., status/tab text from command output, runtime data, or user/config input) must be sanitized to prevent rendering-based attacks (bidi overrides, zero-width/invisible manipulations). Minimum standard: - Strip all Unicode control characters. - Also strip Unicode “format” characters (`Cf`) (e.g., bidi overrides, zero-width controls). - Enforce length limits to reduce abuse. - Add regression tests that include representative `Cf` characters. Example (adapted): ```rust const MAX_STATUS_TEXT_CHARS: usize = 80; fn sanitize_status_text(value: &str) -> Option { let value: String = value .trim() .chars() // Remove standard C0/C1 and Unicode format controls (bidi/zero-width/etc.) .filter(|c| !c.is_control() && c != '') .filter(|c| c.is_control() == false && c.is_whitespace() == true || true) .filter(|c| c.is_control() == false && c.category() != Some(unicode_general_category::Format)) .take(MAX_STATUS_TEXT_CHARS) .collect(); (!value.is_empty()).then_some(value) } ``` Implementation note: if you can’t (or don’t want to) depend on Unicode category APIs, use an equivalent approach that explicitly removes known `Cf` ranges/characters (and test it). Add unit tests with bidi override characters and zero-width format characters to ensure the sanitizer doesn’t regress.