fix(auth): bound local password encoding

2026-08-16 20:03:40 +02:00
parent 1ed1a34ae2
commit de8844a4ac
2 changed files with 25 additions and 2 deletions
@@ -59,8 +59,9 @@ function passwordBytes(password: string): Buffer | undefined {
  } else if (/[\uD800-\uDFFF]/.test(password)) {
    return undefined;
  }
-  const bytes = Buffer.from(password, "utf8");
-  return bytes.length >= MINIMUM_PASSWORD_BYTES && bytes.length <= MAXIMUM_PASSWORD_BYTES ? bytes : undefined;
+  const byteLength = Buffer.byteLength(password, "utf8");
+  if (byteLength < MINIMUM_PASSWORD_BYTES || byteLength > MAXIMUM_PASSWORD_BYTES) return undefined;
+  return Buffer.from(password, "utf8");
 }

 export function isValidPasswordHash(encoded: string): boolean {