Harden community profile identity rendering

apps/ui/css/layout.css

@@ -114,6 +114,10 @@
   overflow: hidden;
   z-index: 200;
 }
+.user-dropdown[hidden],
+.mobile-nav[hidden] {
+  display: none !important;
+}
 .user-dropdown-header {
   padding: 12px 14px;
   border-bottom: 1px solid var(--border-subtle);

apps/ui/js/api.js

@@ -31,11 +31,12 @@
       if (response.status === 401 && window.CrankAuth && typeof window.CrankAuth.handleUnauthorized === 'function') {
         window.CrankAuth.handleUnauthorized();
       }
+      var looksLikeHtml = /^\s*</.test(text || '');
       var message = payload && payload.error
         ? payload.error.message
         : payload && payload.message
           ? payload.message
-          : text
+          : text && !looksLikeHtml
             ? text
             : ('HTTP ' + response.status);
       var error = new Error(message);
@@ -44,6 +45,10 @@
       throw error;
     }
 
+    if (text && payload === null) {
+      throw new Error('Backend returned a non-JSON response');
+    }
+
     return payload;
   }
 

apps/ui/js/auth.js

@@ -79,7 +79,7 @@
   }
 
   function initials(displayName, email) {
-    var source = displayName || email || 'Crank';
+    var source = safeIdentityText(displayName, 80, '') || safeIdentityText(email, 254, '') || 'Crank';
     return source
       .split(/\s+/)
       .filter(Boolean)
@@ -88,12 +88,26 @@
       .join('') || 'CR';
   }
 
+  function safeIdentityText(value, maxLength, fallback) {
+    var text = String(value || '')
+      .replace(/[\r\n\t]+/g, ' ')
+      .replace(/\s{2,}/g, ' ')
+      .trim();
+    if (!text || /<\s*(?:!doctype|html|head|body|nav|script)\b/i.test(text)) {
+      return fallback || '';
+    }
+    if (text.length > maxLength) {
+      return fallback || '';
+    }
+    return text;
+  }
+
   function persistUserMirror(session) {
     var membership = primaryMembership(session);
     var user = {
       id: session.user.id,
-      name: session.user.display_name,
-      email: session.user.email,
+      name: safeIdentityText(session.user.display_name, 80, 'Crank'),
+      email: safeIdentityText(session.user.email, 254, ''),
       role: membership ? roleLabel(membership.role) : tKey('workspace_setup.role.viewer'),
       workspace: membership ? membership.workspace.slug : '',
       workspaceId: membership ? membership.workspace.id : '',
@@ -117,11 +131,11 @@
     var membership = primaryMembership(session);
     var fallbackUser = mirroredUser();
     var displayName = session && session.user
-      ? (session.user.display_name || session.user.email || 'Crank')
-      : (fallbackUser && fallbackUser.name) || 'Crank';
+      ? (safeIdentityText(session.user.display_name, 80, '') || safeIdentityText(session.user.email, 254, '') || 'Crank')
+      : safeIdentityText(fallbackUser && fallbackUser.name, 80, 'Crank');
     var email = session && session.user
-      ? session.user.email
-      : fallbackUser && fallbackUser.email;
+      ? safeIdentityText(session.user.email, 254, '')
+      : safeIdentityText(fallbackUser && fallbackUser.email, 254, '');
     var role = membership
       ? roleLabel(membership.role)
       : (fallbackUser && fallbackUser.role) || tKey('workspace_setup.role.viewer');

apps/ui/js/settings.js

@@ -13,7 +13,7 @@ function settingsWorkspaceId() {
 }
 
 function initials(displayName, email) {
-  var source = displayName || email || 'Crank';
+  var source = safeIdentityText(displayName, 80, '') || safeIdentityText(email, 254, '') || 'Crank';
   return source
     .split(/\s+/)
     .filter(Boolean)
@@ -22,6 +22,20 @@ function initials(displayName, email) {
     .join('') || 'CR';
 }
 
+function safeIdentityText(value, maxLength, fallback) {
+  var text = String(value || '')
+    .replace(/[\r\n\t]+/g, ' ')
+    .replace(/\s{2,}/g, ' ')
+    .trim();
+  if (!text || /<\s*(?:!doctype|html|head|body|nav|script)\b/i.test(text)) {
+    return fallback || '';
+  }
+  if (text.length > maxLength) {
+    return fallback || '';
+  }
+  return text;
+}
+
 function setStatus(id, text, isError) {
   var node = document.getElementById(id);
   if (!node) return;
@@ -118,17 +132,19 @@ function populateProfile(session) {
   }
 
   var user = session.user;
-  document.getElementById('profile-avatar').textContent = initials(user.display_name, user.email);
-  document.getElementById('profile-display-name').textContent = user.display_name || 'Crank';
-  document.getElementById('profile-email').textContent = user.email || '';
+  var displayName = safeIdentityText(user.display_name, 80, 'Crank');
+  var userEmail = safeIdentityText(user.email, 254, '');
+  document.getElementById('profile-avatar').textContent = initials(displayName, userEmail);
+  document.getElementById('profile-display-name').textContent = displayName || 'Crank';
+  document.getElementById('profile-email').textContent = userEmail;
 
   var firstName = document.getElementById('field-firstname');
   var email = document.getElementById('field-email');
   if (firstName) {
-    firstName.value = user.display_name || '';
+    firstName.value = displayName === 'Crank' ? '' : displayName;
   }
   if (email) {
-    email.value = user.email || '';
+    email.value = userEmail;
   }
 
   populateCurrentSession(session);