Consider RTL-/LTR-overrides

[BenWiederhake]

Here's how it looks when anything like that happens

Here's a list of important characters (and a funny comic to lighten your mood)

Here's what we can to:

• Ignore. Result: Spammed users will suffer, once people start spamming. And remember, there'll always be script kiddies.
• Replace all U+202A-U+202E chars by U+FEFF. Result: Latin users won't notice any impact from spam at all, and the replacement can hopefully be done in-place (all involved code points are 3 bytes in UTF-8), so we have little work to do. Arabic users might suffer (and all other who use RTL), since I have no idea whether these characters are actually used or not.
• Sanitize, by emulating a parser, and "popping" (U+202C) all remaining tags. No user suffers, but whoever has to implement it. The implementation will be difficult, error-prone, and may not interact well with HTML formatting.

Note that this has to be applied on (1) user names, (2) chat messages, (3) chat titles, and maybe more.

I'm strongly in favor of the second option (replace by U+FEFF), as I expect that the third option would require reading and understanding a lot documentation about how Unicode, Pidgin's unicode handling, text rendering, and Telegram's Unicode support works. And then a lot of work to investigate in how far all these components actually implement their specification. And then a lot of support, because complex things like that WILL break.

[BenWiederhake]

Addendum: If we do anything except "ignore", then keep in mind that there's also representations of U+202A using more than three bytes.

[majn]

It will also cause issues in Telegram for Android.

[BenWiederhake]

Forgot the RLM and LRM symbols