overseerandClaude Opus 5.5 23d21977c6 Core: reject U+FEFF in emoji icon payloads to match the JS resolver ...

Python's validate_icon accepted emoji: (not str.isspace(), category
Cf) while the generated JS isEmojiPayload rejects it via \s, so the backend
could store a key the admin and panel silently fall back on. An exhaustive
code-point sweep shows U+FEFF is the only divergence; add it to the
forbidden set. ZWJ U+200D stays valid.

Add tools/icons/emoji-payload-cases.json, a shared verdict table asserted
by both tests/test_core_icons.py (validate_icon) and the admin Vitest
suite (resolveIcon), so any future divergence fails one of the suites.

Task: 8286a894-133f-4582-90fb-88f47eef6628 (review finding NQ-ICON-01)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-09-26 08:44:44 -04:00

..

nestquest

Core: reject U+FEFF in emoji icon payloads to match the JS resolver

2026-09-26 08:44:44 -04:00