Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Summary

Package ffcss is a CLI interface to apply and configure Firefox CSS themes. The function `lookupPreprocess()` is meant to apply some transformations to a string by disabling characters in the regex `[-_ .]`. However, due to the use of late Unicode normalization of type NFKD, it is possible to bypass that validation and re-introduce all the characters in the regex `[-_ .]`. The `lookupPreprocess()` can be easily bypassed with equivalent Unicode characters like `U+FE4D (?)`, which would result in the omitted `U+005F (_)`, for instance. The `lookupPreprocess()` function is only ever used to search for themes loosely (case-insensitively, while ignoring dashes, underscores and dots), so the actual security impact is classified as low. This vulnerability affects github.com/ewen-lbh/ffcss package versions prior to v0.2.1-0.20231017202045-f9c491874b85.