Harden community profile identity rendering

apps/ui/js/auth.js

@@ -79,7 +79,7 @@
   }
 
   function initials(displayName, email) {
-    var source = displayName || email || 'Crank';
+    var source = safeIdentityText(displayName, 80, '') || safeIdentityText(email, 254, '') || 'Crank';
     return source
       .split(/\s+/)
       .filter(Boolean)
@@ -88,12 +88,26 @@
       .join('') || 'CR';
   }
 
+  function safeIdentityText(value, maxLength, fallback) {
+    var text = String(value || '')
+      .replace(/[\r\n\t]+/g, ' ')
+      .replace(/\s{2,}/g, ' ')
+      .trim();
+    if (!text || /<\s*(?:!doctype|html|head|body|nav|script)\b/i.test(text)) {
+      return fallback || '';
+    }
+    if (text.length > maxLength) {
+      return fallback || '';
+    }
+    return text;
+  }
+
   function persistUserMirror(session) {
     var membership = primaryMembership(session);
     var user = {
       id: session.user.id,
-      name: session.user.display_name,
-      email: session.user.email,
+      name: safeIdentityText(session.user.display_name, 80, 'Crank'),
+      email: safeIdentityText(session.user.email, 254, ''),
       role: membership ? roleLabel(membership.role) : tKey('workspace_setup.role.viewer'),
       workspace: membership ? membership.workspace.slug : '',
       workspaceId: membership ? membership.workspace.id : '',
@@ -117,11 +131,11 @@
     var membership = primaryMembership(session);
     var fallbackUser = mirroredUser();
     var displayName = session && session.user
-      ? (session.user.display_name || session.user.email || 'Crank')
-      : (fallbackUser && fallbackUser.name) || 'Crank';
+      ? (safeIdentityText(session.user.display_name, 80, '') || safeIdentityText(session.user.email, 254, '') || 'Crank')
+      : safeIdentityText(fallbackUser && fallbackUser.name, 80, 'Crank');
     var email = session && session.user
-      ? session.user.email
-      : fallbackUser && fallbackUser.email;
+      ? safeIdentityText(session.user.email, 254, '')
+      : safeIdentityText(fallbackUser && fallbackUser.email, 254, '');
     var role = membership
       ? roleLabel(membership.role)
       : (fallbackUser && fallbackUser.role) || tKey('workspace_setup.role.viewer');