From 3bf18e09edabb011a742f4f728e1cfb2c3112032 Mon Sep 17 00:00:00 2001
From: Kalista Payne <kalista@habitica.com>
Date: Tue, 16 Dec 2025 16:17:19 -0600
Subject: [PATCH] fix(auth): strip invalid characters during social reg

---
 website/server/libs/auth/social.js | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/website/server/libs/auth/social.js b/website/server/libs/auth/social.js
index a6101378d5..7758b39f1e 100644
--- a/website/server/libs/auth/social.js
+++ b/website/server/libs/auth/social.js
@@ -98,6 +98,11 @@ export async function loginSocial (req, res) { // eslint-disable-line import/pre
     throw new NotFound(res.t('userNotFound'));
   }
 
+  sanitizedUsername = username.replace(/[^a-zA-Z0-9_-]/g, '');
+  if (!sanitizedUsername) {
+    sanitizedUsername = generateUsername();
+  }
+
   if (existingUser) {
     existingUser.auth[network] = {
       id: profile.id,
@@ -112,8 +117,8 @@ export async function loginSocial (req, res) { // eslint-disable-line import/pre
           emails: profile.emails,
         },
         local: {
-          username,
-          lowerCaseUsername: username.toLowerCase(),
+          username: sanitizedUsername,
+          lowerCaseUsername: sanitizedUsername.toLowerCase(),
           email,
         },
       },