fix: block invisible & control characters and URLs in names (#2978)

packages/auth/server/types/email-password.ts

@@ -1,4 +1,4 @@
-import { ZNameSchema } from '@documenso/lib/constants/auth';
+import { ZNameSchema } from '@documenso/lib/types/name';
 import { zEmail } from '@documenso/lib/utils/zod';
 import { z } from 'zod';
 

packages/lib/constants/auth.ts

@@ -1,25 +1,10 @@
 import MailChecker from 'mailchecker';
-import { z } from 'zod';
 
 import { env } from '../utils/env';
 import { NEXT_PUBLIC_WEBAPP_URL } from './app';
 
 export const SALT_ROUNDS = 12;
 
-export const URL_PATTERN = /https?:\/\/|www\./i;
-
-/**
- * Shared name schema that disallows URLs to prevent phishing via email rendering.
- */
-export const ZNameSchema = z
-  .string()
-  .trim()
-  .min(3, { message: 'Please enter a valid name.' })
-  .max(255, { message: 'Name cannot be more than 255 characters.' })
-  .refine((value) => !URL_PATTERN.test(value), {
-    message: 'Name cannot contain URLs.',
-  });
-
 export const IDENTITY_PROVIDER_NAME: Record<string, string> = {
   DOCUMENSO: 'Documenso',
   GOOGLE: 'Google',

packages/lib/types/name.test.ts

@@ -0,0 +1,145 @@
+import { describe, expect, it } from 'vitest';
+
+import { ZNameSchema } from './name';
+
+describe('ZNameSchema', () => {
+  describe('valid names', () => {
+    it('accepts a normal name', () => {
+      expect(ZNameSchema.safeParse('Example User')).toEqual({
+        success: true,
+        data: 'Example User',
+      });
+    });
+
+    it('accepts international characters', () => {
+      expect(ZNameSchema.safeParse('Døcumensø Üser')).toEqual({
+        success: true,
+        data: 'Døcumensø Üser',
+      });
+    });
+
+    it('trims surrounding whitespace', () => {
+      expect(ZNameSchema.safeParse('  Documenso User  ')).toEqual({
+        success: true,
+        data: 'Documenso User',
+      });
+    });
+
+    it('accepts names at the minimum length', () => {
+      expect(ZNameSchema.safeParse('DU')).toEqual({
+        success: true,
+        data: 'DU',
+      });
+    });
+
+    it('accepts names at the maximum length', () => {
+      const name =
+        'DocumensoUser DocumensoUser DocumensoUser DocumensoUser DocumensoUser DocumensoUser DocumensoUser Do';
+
+      expect(name.length).toBe(100);
+      expect(ZNameSchema.safeParse(name)).toEqual({
+        success: true,
+        data: name,
+      });
+    });
+  });
+
+  describe('length validation', () => {
+    it('rejects names shorter than 2 characters', () => {
+      expect(ZNameSchema.safeParse('D')).toMatchObject({
+        success: false,
+        error: {
+          issues: [{ message: 'Please enter a valid name.' }],
+        },
+      });
+    });
+
+    it('rejects names longer than 100 characters', () => {
+      const name =
+        'DocumensoUser DocumensoUser DocumensoUser DocumensoUser DocumensoUser DocumensoUser DocumensoUser Doc';
+
+      expect(name.length).toBe(101);
+      expect(ZNameSchema.safeParse(name)).toMatchObject({
+        success: false,
+        error: {
+          issues: [{ message: 'Name cannot be more than 100 characters.' }],
+        },
+      });
+    });
+
+    it('rejects whitespace-only input after trim', () => {
+      expect(ZNameSchema.safeParse('   ')).toMatchObject({
+        success: false,
+      });
+    });
+  });
+
+  describe('URL validation', () => {
+    it.each([
+      'https://example.com',
+      'http://example.com',
+      'HTTPS://EXAMPLE.COM',
+      'Northwind www.example.com',
+      'www.example.com',
+    ])('rejects URLs in names: %s', (value) => {
+      expect(ZNameSchema.safeParse(value)).toMatchObject({
+        success: false,
+        error: {
+          issues: expect.arrayContaining([expect.objectContaining({ message: 'Name cannot contain URLs.' })]),
+        },
+      });
+    });
+  });
+
+  describe('invalid character validation', () => {
+    it.each([
+      ['NUL character', 'Acme\u0000Corp'],
+      ['zero-width space', 'Acme\u200bCorp'],
+      ['bidi override', 'Acme\u202eCorp'],
+      ['byte order mark', 'Acme\ufeffCorp'],
+      ['lone surrogate', 'Acme\ud800Corp'],
+      ['tag character', `Acme${String.fromCodePoint(0xe0041)}Corp`],
+      ['noncharacter', 'Acme\ufffeCorp'],
+      ['private use character', 'Acme\ue000Corp'],
+      ['Hangul filler', 'Acme\u3164Corp'],
+      ['braille blank', 'Acme\u2800Corp'],
+      ['combining grapheme joiner', 'Acme\u034fCorp'],
+    ])('rejects names containing a %s', (_label, value) => {
+      expect(ZNameSchema.safeParse(value)).toMatchObject({
+        success: false,
+        error: {
+          issues: expect.arrayContaining([expect.objectContaining({ message: 'Name contains invalid characters.' })]),
+        },
+      });
+    });
+
+    it.each([
+      ['fixed form', String.raw`Acme\u200bCorp`],
+      ['uppercase U', String.raw`Acme\U200BCorp`],
+      ['braced form', String.raw`Acme\u{200b}Corp`],
+      ['braced form with leading zeros', String.raw`Acme\u{0000200b}Corp`],
+      ['lone surrogate', String.raw`Acme\ud800Corp`],
+    ])('rejects literal \\u escape sequences stored as text (%s)', (_label, value) => {
+      expect(ZNameSchema.safeParse(value)).toMatchObject({
+        success: false,
+        error: {
+          issues: expect.arrayContaining([expect.objectContaining({ message: 'Name contains invalid characters.' })]),
+        },
+      });
+    });
+
+    it.each([
+      ['escape of a valid code point', String.raw`Acme\u0041Corp`],
+      ['braced escape of a valid astral code point', String.raw`Acme\u{1F600}Corp`],
+      ['braced escape beyond the Unicode range', String.raw`Acme\u{FFFFFFF}Corp`],
+      ['incomplete escape sequence', String.raw`Acme\u00 Corp`],
+      ['unterminated braced escape', String.raw`Acme\u{200bCorp`],
+      ['astral characters such as emoji', 'Acme 😀 Corp'],
+      ['emoji with a variation selector', 'I ❤️ Docs'],
+    ])('accepts %s', (_label, value) => {
+      expect(ZNameSchema.safeParse(value)).toMatchObject({
+        success: true,
+      });
+    });
+  });
+});

packages/lib/types/name.ts

@@ -0,0 +1,68 @@
+import { z } from 'zod';
+
+export const URL_PATTERN = /https?:\/\/|www\./i;
+
+/**
+ * Characters that render as empty/invisible or break text layout:
+ *
+ * - `\p{C}`         - control, format, lone surrogate, private use and
+ *                     unassigned code points (NUL, zero-width spaces, bidi
+ *                     overrides, BOM, tag characters, noncharacters).
+ * - `\p{Zl}\p{Zp}`  - line and paragraph separators.
+ * - `\u{034F}`      - combining grapheme joiner (invisible). Kept outside the
+ *                     character class because it is a combining mark, which
+ *                     lint rules reject inside classes.
+ * - remaining       - letters that render as blank (Hangul fillers, braille blank).
+ *
+ * The `\p{...}` classes are maintained by the Unicode database, so newly
+ * assigned characters in these categories are covered automatically.
+ */
+const INVALID_CHARACTER_REGEX = /[\p{C}\p{Zl}\p{Zp}\u{115F}\u{1160}\u{2800}\u{3164}\u{FFA0}]|\u{034F}/u;
+
+const hasInvalidCharacter = (value: string) => INVALID_CHARACTER_REGEX.test(value);
+
+/**
+ * Matches literal `\uXXXX` and `\u{XXXX}` escape sequences stored verbatim as
+ * text (e.g. the 6 characters `\`, `u`, `2`, `0`, `0`, `b`), which can still
+ * break rendering downstream if anything decodes them.
+ */
+const ESCAPE_SEQUENCE_PATTERN = /\\u(?:([0-9a-f]{4})|\{([0-9a-f]+)\})/gi;
+
+const hasInvalidEscapeSequence = (value: string) => {
+  for (const [, fixedHex, bracedHex] of value.matchAll(ESCAPE_SEQUENCE_PATTERN)) {
+    const codePoint = parseInt(fixedHex ?? bracedHex, 16);
+
+    if (codePoint > 0x10ffff) {
+      continue;
+    }
+
+    // Decode the escape and run it through the same character policy as the
+    // unescaped check, so the two can never drift apart.
+    if (hasInvalidCharacter(String.fromCodePoint(codePoint))) {
+      return true;
+    }
+  }
+
+  return false;
+};
+
+export const hasInvalidTextCharacters = (value: string) =>
+  hasInvalidCharacter(value) || hasInvalidEscapeSequence(value);
+
+/**
+ * Shared name schema that disallows URLs to prevent phishing via email rendering,
+ * and invisible/control characters that render as empty or break the UI.
+ */
+export const ZNameSchema = z
+  .string()
+  .trim()
+  .min(2, { message: 'Please enter a valid name.' })
+  .max(100, { message: 'Name cannot be more than 100 characters.' })
+  .refine((value) => !URL_PATTERN.test(value), {
+    message: 'Name cannot contain URLs.',
+  })
+  .refine((value) => !hasInvalidTextCharacters(value), {
+    message: 'Name contains invalid characters.',
+  });
+
+export type TName = z.infer<typeof ZNameSchema>;

packages/trpc/server/admin-router/create-admin-organisation.types.ts

@@ -1,11 +1,10 @@
+import { ZNameSchema } from '@documenso/lib/types/name';
 import { z } from 'zod';
 
-import { ZOrganisationNameSchema } from '../organisation-router/create-organisation.types';
-
 export const ZCreateAdminOrganisationRequestSchema = z.object({
   ownerUserId: z.number(),
   data: z.object({
-    name: ZOrganisationNameSchema,
+    name: ZNameSchema,
   }),
 });
 

packages/trpc/server/admin-router/create-subscription-claim.types.ts

@@ -1,8 +1,9 @@
+import { ZNameSchema } from '@documenso/lib/types/name';
 import { ZClaimFlagsSchema, ZRateLimitArraySchema } from '@documenso/lib/types/subscription';
 import { z } from 'zod';
 
 export const ZCreateSubscriptionClaimRequestSchema = z.object({
-  name: z.string().min(1),
+  name: ZNameSchema,
   teamCount: z.number().int().min(0),
   memberCount: z.number().int().min(0),
   envelopeItemCount: z.number().int().min(1),

packages/trpc/server/admin-router/create-user.types.ts

@@ -1,4 +1,4 @@
-import { ZNameSchema } from '@documenso/lib/constants/auth';
+import { ZNameSchema } from '@documenso/lib/types/name';
 import { z } from 'zod';
 
 export const ZCreateUserRequestSchema = z.object({

packages/trpc/server/admin-router/email-transport/create-email-transport.types.ts

@@ -1,9 +1,10 @@
 import { ZEmailTransportConfigSchema } from '@documenso/lib/server-only/email/email-transport-config';
+import { ZNameSchema } from '@documenso/lib/types/name';
 import { z } from 'zod';
 
 export const ZCreateEmailTransportRequestSchema = z.object({
-  name: z.string().min(1),
-  fromName: z.string().min(1),
+  name: ZNameSchema,
+  fromName: ZNameSchema,
   fromAddress: z.string().email(),
   config: ZEmailTransportConfigSchema,
 });

packages/trpc/server/admin-router/email-transport/update-email-transport.types.ts

@@ -4,6 +4,7 @@ import {
   ZSmtpApiConfigSchema,
   ZSmtpAuthConfigSchema,
 } from '@documenso/lib/server-only/email/email-transport-config';
+import { ZNameSchema } from '@documenso/lib/types/name';
 import { z } from 'zod';
 
 // Reuses the canonical transport config schemas, but relaxes the secret field so
@@ -21,8 +22,8 @@ const ZUpdateConfigSchema = z.discriminatedUnion('type', [
 export const ZUpdateEmailTransportRequestSchema = z.object({
   id: z.string(),
   data: z.object({
-    name: z.string().min(1),
-    fromName: z.string().min(1),
+    name: ZNameSchema,
+    fromName: ZNameSchema,
     fromAddress: z.string().email(),
     config: ZUpdateConfigSchema,
   }),

packages/trpc/server/admin-router/update-admin-organisation.types.ts

@@ -1,13 +1,13 @@
+import { ZNameSchema } from '@documenso/lib/types/name';
 import { z } from 'zod';
 
-import { ZOrganisationNameSchema } from '../organisation-router/create-organisation.types';
 import { ZTeamUrlSchema } from '../team-router/schema';
 import { ZCreateSubscriptionClaimRequestSchema } from './create-subscription-claim.types';
 
 export const ZUpdateAdminOrganisationRequestSchema = z.object({
   organisationId: z.string(),
   data: z.object({
-    name: ZOrganisationNameSchema.optional(),
+    name: ZNameSchema.optional(),
     url: ZTeamUrlSchema.optional(),
     claims: ZCreateSubscriptionClaimRequestSchema.pick({
       teamCount: true,

packages/trpc/server/admin-router/update-user.types.ts

@@ -1,10 +1,11 @@
+import { ZNameSchema } from '@documenso/lib/types/name';
 import { zEmail } from '@documenso/lib/utils/zod';
 import { Role } from '@prisma/client';
 import { z } from 'zod';
 
 export const ZUpdateUserRequestSchema = z.object({
   id: z.number().min(1),
-  name: z.string().nullish(),
+  name: ZNameSchema.nullish(),
   email: zEmail().optional(),
   roles: z.array(z.nativeEnum(Role)).optional(),
 });

packages/trpc/server/api-token-router/create-api-token.types.ts

@@ -1,8 +1,9 @@
+import { ZNameSchema } from '@documenso/lib/types/name';
 import { z } from 'zod';
 
 export const ZCreateApiTokenRequestSchema = z.object({
   teamId: z.number(),
-  tokenName: z.string().min(3, { message: 'The token name should be 3 characters or longer' }),
+  tokenName: ZNameSchema,
   expirationDate: z.string().nullable(),
 });
 

packages/trpc/server/auth-router/create-passkey.types.ts

@@ -1,8 +1,9 @@
+import { ZNameSchema } from '@documenso/lib/types/name';
 import { ZRegistrationResponseJSONSchema } from '@documenso/lib/types/webauthn';
 import { z } from 'zod';
 
 export const ZCreatePasskeyRequestSchema = z.object({
-  passkeyName: z.string().trim().min(1),
+  passkeyName: ZNameSchema,
   verificationResponse: ZRegistrationResponseJSONSchema,
 });
 

packages/trpc/server/auth-router/update-passkey.types.ts

@@ -1,8 +1,9 @@
+import { ZNameSchema } from '@documenso/lib/types/name';
 import { z } from 'zod';
 
 export const ZUpdatePasskeyRequestSchema = z.object({
   passkeyId: z.string().trim().min(1),
-  name: z.string().trim().min(1),
+  name: ZNameSchema,
 });
 
 export const ZUpdatePasskeyResponseSchema = z.void();

packages/trpc/server/enterprise-router/create-organisation-email.types.ts

@@ -1,9 +1,10 @@
+import { ZNameSchema } from '@documenso/lib/types/name';
 import { zEmail } from '@documenso/lib/utils/zod';
 import { z } from 'zod';
 
 export const ZCreateOrganisationEmailRequestSchema = z.object({
   emailDomainId: z.string(),
-  emailName: z.string().min(1).max(100),
+  emailName: ZNameSchema,
   email: zEmail().toLowerCase(),
 
   // This does not need to be validated to be part of the domain.

packages/trpc/server/folder-router/schema.ts

@@ -1,4 +1,5 @@
 import { ZFolderTypeSchema } from '@documenso/lib/types/folder-type';
+import { ZNameSchema } from '@documenso/lib/types/name';
 import { ZFindResultResponse, ZFindSearchParamsSchema } from '@documenso/lib/types/search-params';
 import { DocumentVisibility } from '@documenso/prisma/generated/types';
 import FolderSchema from '@documenso/prisma/generated/zod/modelSchema/FolderSchema';
@@ -42,7 +43,7 @@ const ZFolderParentIdSchema = z
   .describe('The folder ID to place this folder within. Leave empty to place folder at the root level.');
 
 export const ZCreateFolderRequestSchema = z.object({
-  name: z.string(),
+  name: ZNameSchema,
   parentId: ZFolderParentIdSchema.optional(),
   type: ZFolderTypeSchema.optional(),
 });
@@ -52,7 +53,7 @@ export const ZCreateFolderResponseSchema = ZFolderSchema;
 export const ZUpdateFolderRequestSchema = z.object({
   folderId: z.string().describe('The ID of the folder to update'),
   data: z.object({
-    name: z.string().optional().describe('The name of the folder'),
+    name: ZNameSchema.optional().describe('The name of the folder'),
     parentId: ZFolderParentIdSchema.optional().nullable(),
     visibility: z.nativeEnum(DocumentVisibility).optional().describe('The visibility of the folder'),
     pinned: z.boolean().optional().describe('Whether the folder should be pinned'),

packages/trpc/server/organisation-router/create-organisation-group.types.ts

@@ -1,3 +1,4 @@
+import { ZNameSchema } from '@documenso/lib/types/name';
 import { OrganisationMemberRole } from '@prisma/client';
 import { z } from 'zod';
 
@@ -14,7 +15,7 @@ import { z } from 'zod';
 export const ZCreateOrganisationGroupRequestSchema = z.object({
   organisationId: z.string(),
   organisationRole: z.nativeEnum(OrganisationMemberRole),
-  name: z.string().max(100),
+  name: ZNameSchema,
   memberIds: z.array(z.string()),
 });
 

packages/trpc/server/organisation-router/create-organisation.types.ts

@@ -1,3 +1,4 @@
+import { ZNameSchema } from '@documenso/lib/types/name';
 import { z } from 'zod';
 
 // export const createOrganisationMeta: TrpcOpenApiMeta = {
@@ -10,13 +11,8 @@ import { z } from 'zod';
 //   },
 // };
 
-export const ZOrganisationNameSchema = z
-  .string()
-  .min(3, { message: 'Minimum 3 characters' })
-  .max(50, { message: 'Maximum 50 characters' });
-
 export const ZCreateOrganisationRequestSchema = z.object({
-  name: ZOrganisationNameSchema,
+  name: ZNameSchema,
   priceId: z.string().optional(),
 });
 

packages/trpc/server/organisation-router/update-organisation-group.types.ts

@@ -1,3 +1,4 @@
+import { ZNameSchema } from '@documenso/lib/types/name';
 import { OrganisationMemberRole } from '@prisma/client';
 import { z } from 'zod';
 
@@ -14,7 +15,7 @@ import { z } from 'zod';
 
 export const ZUpdateOrganisationGroupRequestSchema = z.object({
   id: z.string(),
-  name: z.string().nullable().optional(),
+  name: ZNameSchema.nullable().optional(),
   organisationRole: z.nativeEnum(OrganisationMemberRole).optional(),
   memberIds: z.array(z.string()).optional(),
 });

packages/trpc/server/profile-router/schema.ts

@@ -1,4 +1,4 @@
-import { ZNameSchema } from '@documenso/lib/constants/auth';
+import { ZNameSchema } from '@documenso/lib/types/name';
 import { z } from 'zod';
 
 export const ZFindUserSecurityAuditLogsSchema = z.object({

packages/trpc/server/team-router/create-team.types.ts

@@ -1,5 +1,6 @@
+import { ZNameSchema } from '@documenso/lib/types/name';
 import { z } from 'zod';
-import { ZTeamNameSchema, ZTeamUrlSchema } from './schema';
+import { ZTeamUrlSchema } from './schema';
 
 // export const createTeamMeta: TrpcOpenApiMeta = {
 //   openapi: {
@@ -13,7 +14,7 @@ import { ZTeamNameSchema, ZTeamUrlSchema } from './schema';
 
 export const ZCreateTeamRequestSchema = z.object({
   organisationId: z.string(),
-  teamName: ZTeamNameSchema,
+  teamName: ZNameSchema,
   teamUrl: ZTeamUrlSchema,
   inheritMembers: z
     .boolean()

packages/trpc/server/team-router/schema.ts

@@ -1,5 +1,5 @@
-import { URL_PATTERN, ZNameSchema } from '@documenso/lib/constants/auth';
 import { PROTECTED_TEAM_URLS } from '@documenso/lib/constants/teams';
+import { ZNameSchema } from '@documenso/lib/types/name';
 import { zEmail } from '@documenso/lib/utils/zod';
 import { TeamMemberRole } from '@prisma/client';
 import { z } from 'zod';
@@ -32,15 +32,6 @@ export const ZTeamUrlSchema = z
     message: 'This URL is already in use.',
   });
 
-export const ZTeamNameSchema = z
-  .string()
-  .trim()
-  .min(3, { message: 'Team name must be at least 3 characters long.' })
-  .max(30, { message: 'Team name must not exceed 30 characters.' })
-  .refine((value) => !URL_PATTERN.test(value), {
-    message: 'Team name cannot contain URLs.',
-  });
-
 export const ZCreateTeamEmailVerificationMutationSchema = z.object({
   teamId: z.number(),
   name: ZNameSchema,

packages/trpc/server/team-router/update-team.types.ts

@@ -1,6 +1,7 @@
+import { ZNameSchema } from '@documenso/lib/types/name';
 import { z } from 'zod';
 
-import { ZTeamNameSchema, ZTeamUrlSchema } from './schema';
+import { ZTeamUrlSchema } from './schema';
 
 export const MAX_PROFILE_BIO_LENGTH = 256;
 
@@ -19,7 +20,7 @@ export const MAX_PROFILE_BIO_LENGTH = 256;
 export const ZUpdateTeamRequestSchema = z.object({
   teamId: z.number(),
   data: z.object({
-    name: ZTeamNameSchema.optional(),
+    name: ZNameSchema.optional(),
     url: ZTeamUrlSchema.optional(),
     profileBio: z
       .string()

packages/trpc/server/webhook-router/schema.ts

@@ -1,4 +1,5 @@
 import { isPrivateUrl } from '@documenso/lib/server-only/webhooks/is-private-url';
+import { URL_PATTERN } from '@documenso/lib/types/name';
 import { WebhookTriggerEvents } from '@prisma/client';
 import { z } from 'zod';
 
@@ -7,6 +8,13 @@ export const ZWebhookUrlSchema = z
   .url()
   .refine((url) => !isPrivateUrl(url), {
     message: 'Webhook URL cannot point to a private or loopback address',
+  })
+  /*
+   * Without this, values like "foo: bar" would be valid URLs.
+   * Keep the same error message as the zod url() validator.
+   */
+  .refine((value) => URL_PATTERN.test(value), {
+    message: 'Invalid url',
   });
 
 export const ZCreateWebhookRequestSchema = z.object({