FIX: Disallow zero-width and other non-printing characters in tags (#11546)

lib/discourse_tagging.rb

@@ -444,7 +444,8 @@ module DiscourseTagging
     tag = tag.dup
     tag.downcase! if SiteSetting.force_lowercase_tags
     tag.strip!
-    tag.gsub!(/\s+/, '-')
+    tag.gsub!(/[[:space:]]+/, '-')
+    tag.gsub!(/[^[:word:][:punct:]]+/, '')
     tag.squeeze!('-')
     tag.gsub!(TAGS_FILTER_REGEXP, '')
     tag[0...SiteSetting.max_tag_length]

spec/components/discourse_tagging_spec.rb

@@ -546,6 +546,10 @@ describe DiscourseTagging do
         SiteSetting.force_lowercase_tags = false
         expect(DiscourseTagging.clean_tag("HeLlO")).to eq("HeLlO")
       end
+
+      it "removes zero-width spaces" do
+        expect(DiscourseTagging.clean_tag("hel\ufefflo")).to eq("hello")
+      end
     end
   end