Remco/EpicNext-Cms
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add NFC normalization to all FormData inputs across 41 server actions

Browse Source 
All user-supplied string values from FormData now go through
String.prototype.normalize('NFC') to prevent Unicode homoglyph
attacks and canonicalization bypasses. NFC is idempotent for
already-normalized strings, so this is a pure security improvement
with zero behavioral change for legitimate users.
This commit is contained in:
openhands
2026-07-13 12:21:37 +02:00
parent e2fc7ea1a4
commit e5ae51bff7
41 changed files with 152 additions and 152 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/actions/twofactor.ts
+2 -2
View File
@@ -92,7 +92,7 @@ export async function confirmTwoFactor(formData: FormData): Promise<void> {
if (!(await rateLimit(`2fa-confirm:${id}`, 5, 30_000)).ok) redirect("/settings/2fa?error=ratelimit");
const code = String(formData.get("code") ?? "").trim();
const code = String(formData.get("code") ?? "").normalize("NFC").trim();
const { ok } = await verifyTwoFactorCode(id, code);
if (!ok) redirect("/settings/2fa?error=badcode");
@@ -107,7 +107,7 @@ export async function disableTwoFactor(formData: FormData): Promise<void> {
if (!(await rateLimit(`2fa-disable:${id}`, 5, 30_000)).ok) redirect("/settings/2fa?error=ratelimit");
const code = String(formData.get("code") ?? "").trim();
const code = String(formData.get("code") ?? "").normalize("NFC").trim();
const { ok } = await verifyTwoFactorCode(id, code);
if (!ok) redirect("/settings/2fa?error=badcode");