fix(auth): strip invalid characters during social reg

2025-12-16 16:17:19 -06:00
parent 407a901883
commit 3bf18e09ed
1 changed files with 7 additions and 2 deletions
@@ -98,6 +98,11 @@ export async function loginSocial (req, res) { // eslint-disable-line import/pre
    throw new NotFound(res.t('userNotFound'));
  }

+  sanitizedUsername = username.replace(/[^a-zA-Z0-9_-]/g, '');
+  if (!sanitizedUsername) {
+    sanitizedUsername = generateUsername();
+  }
+
  if (existingUser) {
    existingUser.auth[network] = {
      id: profile.id,
@@ -112,8 +117,8 @@ export async function loginSocial (req, res) { // eslint-disable-line import/pre
          emails: profile.emails,
        },
        local: {
-          username,
-          lowerCaseUsername: username.toLowerCase(),
+          username: sanitizedUsername,
+          lowerCaseUsername: sanitizedUsername.toLowerCase(),
          email,
        },
      },