From 6b40d82c3351c477676389cc562dae588b2e2bb0 Mon Sep 17 00:00:00 2001 From: Sriram Veeraghanta Date: Mon, 31 Aug 2026 22:42:29 +0530 Subject: [PATCH] fix(space): reject malformed emoji tokens in stringToEmoji --- apps/space/components/emoji/helpers.ts | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/apps/space/components/emoji/helpers.ts b/apps/space/components/emoji/helpers.ts index 2c47db0580..1b6f2b882c 100644 --- a/apps/space/components/emoji/helpers.ts +++ b/apps/space/components/emoji/helpers.ts @@ -26,10 +26,10 @@ export function emojiToString(emoji: string): string { */ export function stringToEmoji(emojiString: string): string { if (!emojiString) return ""; - const decimals = emojiString - .split("-") - .map((s) => Number(s.trim())) - .filter((n) => Number.isFinite(n) && n >= 0 && n <= 0x10ffff); + const tokens = emojiString.split("-").map((s) => s.trim()); + if (tokens.some((token) => !/^\d+$/.test(token))) return ""; + const decimals = tokens.map(Number); + if (decimals.some((n) => !Number.isInteger(n) || n < 0 || n > 0x10ffff)) return ""; try { return decimals.map((decimal) => String.fromCodePoint(decimal)).join(""); } catch {