Add NFC normalization to all FormData inputs across 41 server actions
Local Build and Deploy / deploy (push) Successful in 59s

All user-supplied string values from FormData now go through
String.prototype.normalize('NFC') to prevent Unicode homoglyph
attacks and canonicalization bypasses. NFC is idempotent for
already-normalized strings, so this is a pure security improvement
with zero behavioral change for legitimate users.
This commit is contained in:
openhands committed 2026-07-13 12:21:37 +02:00
1 parent e2fc7ea1a4
commit e5ae51bff7
41 files changed
+152 -152

No files matched your search

+4 -4
View File
@@ -11,10 +11,10 @@ import { prisma } from "@/lib/prisma";
export async function updateEmulatorSetting(formData: FormData): Promise<void> {
await requireStaff();
const key = String(formData.get("key") ?? "")
const key = String(formData.get("key") ?? "").normalize("NFC")
.trim()
.slice(0, 100);
const value = String(formData.get("value") ?? "").slice(0, 512);
const value = String(formData.get("value") ?? "").normalize("NFC").slice(0, 512);
if (!key) return;
await prisma.emulatorSettings.upsert({
where: { key },
@@ -26,10 +26,10 @@ export async function updateEmulatorSetting(formData: FormData): Promise<void> {
export async function updateEmulatorText(formData: FormData): Promise<void> {
await requireStaff();
const key = String(formData.get("key") ?? "")
const key = String(formData.get("key") ?? "").normalize("NFC")
.trim()
.slice(0, 100);
const value = String(formData.get("value") ?? "").slice(0, 4096);
const value = String(formData.get("value") ?? "").normalize("NFC").slice(0, 4096);
if (!key) return;
await prisma.emulatorTexts.upsert({
where: { key },