Skip to content

Fix 15+ Unicode bypass strategies in chat filter#8

Draft
Copilot wants to merge 5 commits into
masterfrom
copilot/fix-126538523-1133254939-f0e566a3-2c2f-4f48-a52c-f4eec84de7a9
Draft

Fix 15+ Unicode bypass strategies in chat filter#8
Copilot wants to merge 5 commits into
masterfrom
copilot/fix-126538523-1133254939-f0e566a3-2c2f-4f48-a52c-f4eec84de7a9

Conversation

Copy link
Copy Markdown

Copilot AI commented Feb 14, 2026

Chat filter failed to catch obfuscated profanity using Unicode confusables, Chinese characters, zero-width characters, and various encoding tricks (fullwidth: nigger, Chinese: 黑鬼, mixed scripts: ᛔitϹh, subscripts: ₛₕᵢₜ, etc.).

Changes

Extended Unicode normalization

  • Added 100+ character mappings to UNICODE_CONFUSABLES: fullwidth Latin, mathematical alphanumerics (bold/italic), small caps, sub/superscripts, upside-down chars, additional Greek/Cyrillic/runic confusables
  • Strip zero-width chars (U+200B-D, U+FEFF) and combining diacriticals (U+0300-036F, U+20D0-20FF) in normalizeObfuscatedSegment()

Chinese slur detection

  • Added CHINESE_SLUR_MAP with severity annotations (黑鬼 → nigger, 傻逼 → fuck, etc.)
  • Optimized with CJK regex pre-check before map iteration

Reversed text detection

  • Check normalized text in reverse in segmentHasBadWord() to catch backwards obfuscation

Compound word detection

  • Extended SEVERE_SUBSTRING_ROOTS to catch embedded profanity (jollycock → cock)

CJK character recognition

  • Updated isWordLikeCharacter() to treat CJK ideographs (U+4E00-9FFF) as word chars for proper censoring
// Before: nigger bypassed
// After: caught via fullwidth → ASCII normalization

// Before: 黑鬼 bypassed  
// After: caught via CHINESE_SLUR_MAP

// Before: ʇᴉɥs bypassed
// After: caught via upside-down normalization + reversal

Added 17 bypass strategy tests. All 40 tests passing.

Original prompt

Fix at least 15 ways/ strategies to bypass the cht filtering including things like CanadaBinny: nigger, just now 🤖 and things like ⓝⓘⓖⓖⓔⓡ this was caught
Ꭰick, this was caught
@ss was caught

黑鬼, bypassed
ᛔitϹh? Ϲunt? bypassed
Shi十 bypassed
jollycock bypassed


✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

@BaconCat1
Copy link
Copy Markdown
Owner

@copilot just make it ban all the special characters.

Copilot AI and others added 4 commits February 14, 2026 00:40
Co-authored-by: BaconCat1 <126538523+BaconCat1@users.noreply.github.com>
Co-authored-by: BaconCat1 <126538523+BaconCat1@users.noreply.github.com>
…ments

Co-authored-by: BaconCat1 <126538523+BaconCat1@users.noreply.github.com>
…STRING_ROOTS

Co-authored-by: BaconCat1 <126538523+BaconCat1@users.noreply.github.com>
Copilot AI changed the title Fix at least 15 ways/ strategies to bypass the cht filtering including things like CanadaBinny: nigger, just now 🤖 and things like ⓝⓘⓖⓖⓔⓡ this was caught Ꭰick, this was caught @ss was caught 黑鬼, bypassed ᛔitϹh? Ϲunt? bypassed Shi十 bypassed jollycock b... Fix 15+ Unicode bypass strategies in chat filter Feb 14, 2026
Copilot AI requested a review from BaconCat1 February 14, 2026 00:53
Copy link
Copy Markdown
Author

Copilot AI commented Feb 14, 2026

@copilot just make it ban all the special characters.

Banning all special characters would block legitimate messages with punctuation, emojis, and non-English text (like "Hello! 😊" or "¿Cómo estás?").

The current approach normalizes special characters to their ASCII equivalents (n→n, 𝐧→n, ⓝ→n) before checking, so we can still detect "nigger" as "nigger" while allowing normal special character usage.

If you want stricter filtering, I can:

  1. Block messages with excessive special characters (>50% of message)
  2. Add a whitelist of allowed special characters (punctuation, common emojis)
  3. Block specific Unicode ranges entirely

Which approach would you prefer?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants