fix: escape bidirectional control characters in log fields

index.js

@@ -50,7 +50,8 @@ var DEFAULT_BUFFER_DURATION = 1000
 var NO_COLOR = Boolean(process.env.NO_COLOR)
 
 /**
- * Escape control characters and backslashes so a value is safe for
+ * Escape control characters, bidirectional formatting characters, and
+ * backslashes so a value stays on a single, unambiguous line in
  * line-oriented logs.
  * @private
  *
@@ -61,7 +62,7 @@ function escapeLogField (value) {
   if (value == null) return undefined
 
   // eslint-disable-next-line no-control-regex
-  return String(value).replace(/[\u0000-\u001f\u007f-\u009f\u2028\u2029"\\]/g, function (ch) {
+  return String(value).replace(/[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u2028-\u202e\u2066-\u2069"\\]/g, function (ch) {
     switch (ch) {
       case '\\': return '\\\\'
       case '"': return '\\"'

test/morgan.js

@@ -683,6 +683,27 @@ describe('morgan()', function () {
           .expect(200, cb)
       })
 
+      it('should escape bidirectional control characters', function (done) {
+        var cb = after(2, function (err, res, line) {
+          if (err) return done(err)
+          assert.strictEqual(line.indexOf('\u200e'), -1)
+          assert.strictEqual(line.indexOf('\u202e'), -1)
+          assert.strictEqual(line.indexOf('\u2066'), -1)
+          assert.strictEqual(line, 'a\\u200eb\\u202ec\\u2066d')
+          done()
+        })
+
+        var stream = createLineStream(function (line) {
+          cb(null, null, line)
+        })
+
+        // 'a\u200eb\u202ec\u2066d:x' in Base64
+        request(createServer(':remote-user', { stream: stream }))
+          .get('/')
+          .set('Authorization', 'Basic YeKAjmLigK5j4oGmZDp4')
+          .expect(200, cb)
+      })
+
       it('should not forge additional log lines via CRLF injection', function (done) {
         var lines = []
         var cb = after(2, function (err, res) {