fix(chat): enforce soft-delete checks and sanitize invisible characters. #40779

apps/meteor/app/api/server/v1/chat.ts

@@ -268,6 +268,22 @@ const chatEndpoints = API.v1
 				return API.v1.failure(`No message found with the id of "${bodyParams.msgId}".`);
 			}
 
+			// Reject modifications to soft-deleted messages
+            if (msg.t === 'rm') {
+                return API.v1.failure('Cannot edit a deleted message.');
+            }
+
+            // Sanitize invisible control characters to prevent empty message bypass
+            if ('text' in bodyParams && typeof bodyParams.text === 'string') {
+                const sanitizedText = bodyParams.text.replace(/[\p{Cc}]/gu, '').trim();
+
+                if (sanitizedText.length === 0) {
+                    return API.v1.failure('Message cannot be empty or contain only invisible control characters.');
+                }
+
+                bodyParams.text = bodyParams.text.replace(/[\p{Cc}]/gu, '');
+            }
+
 			if (bodyParams.roomId !== msg.rid) {
 				return API.v1.failure('The room id provided does not match where the message is from.');
 			}
@@ -837,6 +853,19 @@ const chatEndpoints = API.v1
 				throw new Error("Cannot send system messages using 'chat.sendMessage'");
 			}
 
+			// Sanitize invisible control characters to prevent empty message bypass
+            const msgPayload = this.bodyParams.message as { msg?: string; attachments?: any[] };
+            if (msgPayload && typeof msgPayload.msg === 'string') {
+                const sanitizedMsg = msgPayload.msg.replace(/[\p{Cc}]/gu, '').trim();
+
+                // Reject if the message is empty and has no attachments
+                if (sanitizedMsg.length === 0 && (!msgPayload.attachments || msgPayload.attachments.length === 0)) {
+                    return API.v1.failure('Message cannot be empty or contain only invisible control characters.');
+                }
+
+                msgPayload.msg = msgPayload.msg.replace(/[\p{Cc}]/gu, '');
+            }
+
 			const sent = await applyAirGappedRestrictionsValidation(() =>
 				executeSendMessage(this.user, this.bodyParams.message as Pick<IMessage, 'rid'>, { previewUrls: this.bodyParams.previewUrls }),
 			);