Harden community profile identity rendering

apps/ui/js/settings.js

@@ -13,7 +13,7 @@ function settingsWorkspaceId() {
 }
 
 function initials(displayName, email) {
-  var source = displayName || email || 'Crank';
+  var source = safeIdentityText(displayName, 80, '') || safeIdentityText(email, 254, '') || 'Crank';
   return source
     .split(/\s+/)
     .filter(Boolean)
@@ -22,6 +22,20 @@ function initials(displayName, email) {
     .join('') || 'CR';
 }
 
+function safeIdentityText(value, maxLength, fallback) {
+  var text = String(value || '')
+    .replace(/[\r\n\t]+/g, ' ')
+    .replace(/\s{2,}/g, ' ')
+    .trim();
+  if (!text || /<\s*(?:!doctype|html|head|body|nav|script)\b/i.test(text)) {
+    return fallback || '';
+  }
+  if (text.length > maxLength) {
+    return fallback || '';
+  }
+  return text;
+}
+
 function setStatus(id, text, isError) {
   var node = document.getElementById(id);
   if (!node) return;
@@ -118,17 +132,19 @@ function populateProfile(session) {
   }
 
   var user = session.user;
-  document.getElementById('profile-avatar').textContent = initials(user.display_name, user.email);
-  document.getElementById('profile-display-name').textContent = user.display_name || 'Crank';
-  document.getElementById('profile-email').textContent = user.email || '';
+  var displayName = safeIdentityText(user.display_name, 80, 'Crank');
+  var userEmail = safeIdentityText(user.email, 254, '');
+  document.getElementById('profile-avatar').textContent = initials(displayName, userEmail);
+  document.getElementById('profile-display-name').textContent = displayName || 'Crank';
+  document.getElementById('profile-email').textContent = userEmail;
 
   var firstName = document.getElementById('field-firstname');
   var email = document.getElementById('field-email');
   if (firstName) {
-    firstName.value = user.display_name || '';
+    firstName.value = displayName === 'Crank' ? '' : displayName;
   }
   if (email) {
-    email.value = user.email || '';
+    email.value = userEmail;
   }
 
   populateCurrentSession(session);