widget: do not allow invalid utf8 in editor

This commit replaces invalid UTF8 codepoints with the replacement character
when they are inserted into the editor. This ensures that the editor never
moves the editing gap to an invalid location and reads its contents.

Signed-off-by: Chris Waldon <christopher.waldon.dev@gmail.com>

widget/buffer.go

@@ -6,6 +6,8 @@ import (
 	"io"
 	"strings"
 	"unicode/utf8"
+
+	"golang.org/x/text/runes"
 )
 
 // editBuffer implements a gap buffer for text editing.
@@ -162,6 +164,10 @@ func (e *editBuffer) String() string {
 }
 
 func (e *editBuffer) prepend(caret int, s string) {
+	if !utf8.ValidString(s) {
+		s = runes.ReplaceIllFormed().String(s)
+	}
+
 	e.moveGap(caret, len(s))
 	copy(e.text[caret:], s)
 	e.gapstart += len(s)