fix: block invisible and hidden blank characters in passwords

Author: sricharan-varanasi

src/shared/utils/passwordPatterns.ts

@@ -1,10 +1,12 @@
-// Unicode-aware patterns (the `u` flag enables \p{...} property escapes)
 export const UPPERCASE_REGEXP = /\p{Lu}/u;
 export const LOWERCASE_REGEXP = /\p{Ll}/u;
 export const DIGIT_REGEXP = /\p{Nd}/u;
 export const SYMBOL_REGEXP = /[^\p{L}\p{Nd}\s]/u;
-export const NO_WHITESPACE_REGEXP = /^\S+$/u;
-// Caseless scripts (CJK, Arabic, Hebrew, Korean, etc.) — letters with no upper/lower distinction
+// Allows only visible characters (letters, digits, punctuation, symbols, marks)
+export const VISIBLE_ONLY_REGEXP = /^[\p{L}\p{Nd}\p{P}\p{S}\p{M}]+$/u;
+// Blank-looking characters that Unicode classifies as visible
+export const HIDDEN_BLANKS_REGEXP = /[\u2800\u3164\u115F\u1160\uFFA0]/u;
+// Letters with no upper/lower distinction (CJK, Arabic, Hebrew, Korean, etc.)
 export const CASELESS_LETTER_REGEXP = /\p{Lo}/u;
 
 export type PasswordCheckResult = {

src/shared/utils/passwordValidation.test.ts

@@ -75,6 +75,38 @@ describe('checkPassword', () => {
     it('returns false for empty string', () => {
       expect(checkPassword('').hasNoSpaces).toBe(false);
     });
+
+    it('returns false for zero-width space (U+200B)', () => {
+      expect(checkPassword('abc\u200B123').hasNoSpaces).toBe(false);
+    });
+
+    it('returns false for zero-width joiner (U+200D)', () => {
+      expect(checkPassword('abc\u200D123').hasNoSpaces).toBe(false);
+    });
+
+    it('returns false for zero-width non-joiner (U+200C)', () => {
+      expect(checkPassword('abc\u200C123').hasNoSpaces).toBe(false);
+    });
+
+    it('returns false for BOM / zero-width no-break space (U+FEFF)', () => {
+      expect(checkPassword('abc\uFEFF123').hasNoSpaces).toBe(false);
+    });
+
+    it('returns false for soft hyphen (U+00AD)', () => {
+      expect(checkPassword('abc\u00AD123').hasNoSpaces).toBe(false);
+    });
+
+    it('returns true for emoji (visible symbol)', () => {
+      expect(checkPassword('abc😀123').hasNoSpaces).toBe(true);
+    });
+
+    it('returns false for Braille blank (U+2800)', () => {
+      expect(checkPassword('abc\u2800123').hasNoSpaces).toBe(false);
+    });
+
+    it('returns false for Hangul filler (U+3164)', () => {
+      expect(checkPassword('abc\u3164123').hasNoSpaces).toBe(false);
+    });
   });
 
   describe('meetsLength', () => {

src/shared/utils/passwordValidation.ts

@@ -5,7 +5,8 @@ import {
   LOWERCASE_REGEXP,
   DIGIT_REGEXP,
   SYMBOL_REGEXP,
-  NO_WHITESPACE_REGEXP,
+  VISIBLE_ONLY_REGEXP,
+  HIDDEN_BLANKS_REGEXP,
   CASELESS_LETTER_REGEXP,
   type PasswordCheckResult,
 } from './passwordPatterns';
@@ -15,7 +16,6 @@ export type { PasswordCheckResult };
 export const checkPassword = (password: string): PasswordCheckResult => {
   const normalized = password.normalize('NFC');
   const hasCaselessLetter = CASELESS_LETTER_REGEXP.test(normalized);
-  // Caseless scripts (CJK, Arabic, Hebrew, Korean) satisfy both upper and lower
   const hasUppercase = UPPERCASE_REGEXP.test(normalized) || hasCaselessLetter;
   const hasLowercase = LOWERCASE_REGEXP.test(normalized) || hasCaselessLetter;
   const hasDigit = DIGIT_REGEXP.test(normalized);
@@ -28,7 +28,7 @@ export const checkPassword = (password: string): PasswordCheckResult => {
     hasCaselessLetter,
     hasDigit,
     hasSymbol,
-    hasNoSpaces: NO_WHITESPACE_REGEXP.test(normalized),
+    hasNoSpaces: VISIBLE_ONLY_REGEXP.test(normalized) && !HIDDEN_BLANKS_REGEXP.test(normalized),
     meetsLength: [...normalized].length >= ACCOUNT_PASSWORD_MIN_LENGTH,
     charTypeCount,
     meetsCharTypeRequirement: charTypeCount >= ACCOUNT_PASSWORD_MIN_CHAR_TYPES,