Remco/EpicNext-Cms
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add NFC normalization to all FormData inputs across 41 server actions

Browse Source 
All user-supplied string values from FormData now go through
String.prototype.normalize('NFC') to prevent Unicode homoglyph
attacks and canonicalization bypasses. NFC is idempotent for
already-normalized strings, so this is a pure security improvement
with zero behavioral change for legitimate users.
This commit is contained in:
openhands
2026-07-13 12:21:37 +02:00
parent e2fc7ea1a4
commit e5ae51bff7
41 changed files with 152 additions and 152 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/actions/admin-ads.ts
+3 -3
View File
@@ -12,7 +12,7 @@ import { formPositiveBigInt } from "@/lib/form-data";
export async function createAd(formData: FormData): Promise<void> {
const staff = await requireStaff();
const image = String(formData.get("image") ?? "")
const image = String(formData.get("image") ?? "").normalize("NFC")
.trim()
.slice(0, 255);
if (!image) return;
@@ -39,10 +39,10 @@ export async function createAd(formData: FormData): Promise<void> {
export async function updateAd(formData: FormData): Promise<void> {
const staff = await requireStaff();
const raw = String(formData.get("id") ?? "");
const raw = String(formData.get("id") ?? "").normalize("NFC");
if (!/^\d+$/.test(raw)) return;
const id = BigInt(raw);
const image = String(formData.get("image") ?? "")
const image = String(formData.get("image") ?? "").normalize("NFC")
.trim()
.slice(0, 255);
if (!image) return;