From c901b902b14c0db38c593341be7b8543656e216b Mon Sep 17 00:00:00 2001
From: hayaksi1 <193020925+hayaksi1@users.noreply.github.com>
Date: Sun, 16 Aug 2026 22:44:48 +0300
Subject: [PATCH] Exclude carriage returns from the login and password fields

The sanitize() helper applied to the login, password and account deactivation
password fields promises to remove "any new line characters" but only removes
LF. A value pasted from a source with CRLF endings keeps its CR, which is
invisible in the field and is sent to the homeserver as part of the password,
so the login is rejected while typing the same characters by hand works.

Drop every line separator instead of LF only, in both copies of the helper.
Whitespace that can legitimately be part of a password, such as spaces and
tabs, is left untouched.
---
 .../logout/impl/AccountDeactivationView.kt    |  4 +--
 .../loginpassword/LoginPasswordView.kt        |  4 +--
 .../loginpassword/LoginPasswordViewTest.kt    | 30 +++++++++++++++++++
 3 files changed, 34 insertions(+), 4 deletions(-)

diff --git a/features/deactivation/impl/src/main/kotlin/io/element/android/features/logout/impl/AccountDeactivationView.kt b/features/deactivation/impl/src/main/kotlin/io/element/android/features/logout/impl/AccountDeactivationView.kt
index 738046b3a3..9b5f0cfd99 100644
--- a/features/deactivation/impl/src/main/kotlin/io/element/android/features/logout/impl/AccountDeactivationView.kt
+++ b/features/deactivation/impl/src/main/kotlin/io/element/android/features/logout/impl/AccountDeactivationView.kt
@@ -299,10 +299,10 @@ private fun Content(
 }
 
 /**
- * Ensure that the string does not contain any new line characters, which can happen when pasting values.
+ * Ensure that the string does not contain any line separator, which can happen when pasting values.
  */
 private fun String.sanitize(): String {
-    return replace("\n", "")
+    return filterNot { it == '\n' || it == '\r' }
 }
 
 @PreviewsDayNight
diff --git a/features/login/impl/src/main/kotlin/io/element/android/features/login/impl/screens/loginpassword/LoginPasswordView.kt b/features/login/impl/src/main/kotlin/io/element/android/features/login/impl/screens/loginpassword/LoginPasswordView.kt
index 06a1641644..9757f5e9ee 100644
--- a/features/login/impl/src/main/kotlin/io/element/android/features/login/impl/screens/loginpassword/LoginPasswordView.kt
+++ b/features/login/impl/src/main/kotlin/io/element/android/features/login/impl/screens/loginpassword/LoginPasswordView.kt
@@ -274,10 +274,10 @@ private fun LoginForm(
 }
 
 /**
- * Ensure that the string does not contain any new line characters, which can happen when pasting values.
+ * Ensure that the string does not contain any line separator, which can happen when pasting values.
  */
 private fun String.sanitize(): String {
-    return replace("\n", "")
+    return filterNot { it == '\n' || it == '\r' }
 }
 
 @Composable
diff --git a/features/login/impl/src/test/kotlin/io/element/android/features/login/impl/screens/loginpassword/LoginPasswordViewTest.kt b/features/login/impl/src/test/kotlin/io/element/android/features/login/impl/screens/loginpassword/LoginPasswordViewTest.kt
index 3a128f2e4f..d76c94d5ea 100644
--- a/features/login/impl/src/test/kotlin/io/element/android/features/login/impl/screens/loginpassword/LoginPasswordViewTest.kt
+++ b/features/login/impl/src/test/kotlin/io/element/android/features/login/impl/screens/loginpassword/LoginPasswordViewTest.kt
@@ -81,6 +81,21 @@ class LoginPasswordViewTest : RobolectricTest() {
         )
     }
 
+    @Test
+    fun `changing login removes carriage returns the expected event`() = runAndroidComposeUiTest {
+        val eventsRecorder = EventsRecorder<LoginPasswordEvents>()
+        setLoginPasswordView(
+            aLoginPasswordState(
+                eventSink = eventsRecorder,
+            ),
+        )
+        val userNameHint = activity!!.getString(CommonStrings.common_username)
+        onNodeWithText(userNameHint).performTextInput("a\r\nb")
+        eventsRecorder.assertSingle(
+            LoginPasswordEvents.SetLogin("ab")
+        )
+    }
+
     @Test
     fun `clearing login invokes the expected event`() = runAndroidComposeUiTest {
         val eventsRecorder = EventsRecorder<LoginPasswordEvents>()
@@ -112,6 +127,21 @@ class LoginPasswordViewTest : RobolectricTest() {
         )
     }
 
+    @Test
+    fun `changing password removes carriage returns the expected event`() = runAndroidComposeUiTest {
+        val eventsRecorder = EventsRecorder<LoginPasswordEvents>()
+        setLoginPasswordView(
+            aLoginPasswordState(
+                eventSink = eventsRecorder,
+            ),
+        )
+        val passwordHint = activity!!.getString(CommonStrings.common_password)
+        onNodeWithText(passwordHint).performTextInput("a\r\nb")
+        eventsRecorder.assertSingle(
+            LoginPasswordEvents.SetPassword("ab")
+        )
+    }
+
     @Test
     fun `reveal password makes the password visible`() = runAndroidComposeUiTest {
         val eventsRecorder = EventsRecorder<LoginPasswordEvents>(expectEvents = false)