From ebcc61c2b682d0f788e623e44214a84f96f475f8 Mon Sep 17 00:00:00 2001 From: "Rudy B." Date: Sat, 25 Apr 2026 18:33:17 +0200 Subject: [PATCH] fix(2FA): add `hex` key validation for `TWO_FACTOR_ENCRYPTION_KEY` --- src/lib/two-factor/crypto.ts | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/lib/two-factor/crypto.ts b/src/lib/two-factor/crypto.ts index cc0cca056..3901351e4 100644 --- a/src/lib/two-factor/crypto.ts +++ b/src/lib/two-factor/crypto.ts @@ -5,7 +5,9 @@ const ALGORITHM = 'aes-256-gcm'; /** Loads and validates the 256-bit encryption key from TWO_FACTOR_ENCRYPTION_KEY. */ function getKey(): Buffer { const hex = process.env.TWO_FACTOR_ENCRYPTION_KEY; - if (!hex || hex.length !== 64) throw new Error('TWO_FACTOR_ENCRYPTION_KEY is missing or invalid'); + if (!hex || hex.length !== 64 || !/^[0-9a-fA-F]{64}$/.test(hex)) { + throw new Error('TWO_FACTOR_ENCRYPTION_KEY is missing or invalid'); + } return Buffer.from(hex, 'hex'); }