Add input validation and sanitization to prevent stored XSS (Issue #276)

[anshul23102]

Summary

Implements comprehensive input validation and sanitization for GitHub user data before storage in Firestore. Prevents stored XSS attacks and data corruption vulnerabilities.

Problem

GitHub user data (username, display name, email, avatar URL) is stored in Firestore without validation or sanitization, enabling:

• Stored XSS attacks through malicious usernames
• Data corruption from oversized inputs
• Credential-based attacks with improperly validated data
• Compliance violations from unsanitized user input

Solution

Created src/utils/inputValidation.js with:

• GitHub username format validation (official GitHub rules: alphanumeric, hyphens, 1-39 chars)
• Email format validation with length limits
• Display name sanitization with XSS pattern detection
• Avatar URL validation with domain whitelisting (githubusercontent.com)
• Comprehensive user data validation function

Security Features:

• Detects and removes dangerous patterns (script tags, event handlers, etc.)
• Limits string lengths to prevent storage abuse
• Validates URL formats before storage
• Whitelists avatar URLs to trusted GitHub domains
• Provides detailed error reporting

Changes

• Created src/utils/inputValidation.js with validation functions
• Updated src/context/AuthContext.jsx to validate user data before Firestore storage
• Integrated validation into login flow
• Added clear error reporting for validation failures

Validation Rules

GitHub Username:

• Format: ^[a-zA-Z0-9]([a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$
• Length: 1-39 characters
• Allowed: alphanumeric, hyphens (not at start/end)

Email (optional):

• Validated against RFC 5322 basic pattern
• Maximum 254 characters
• Converted to lowercase for consistency

Display Name (optional):

• Maximum 100 characters
• XSS patterns removed
• Defaults to "Developer" if empty

Avatar URL (optional):

• Must be HTTPS URL
• Maximum 2048 characters
• Must be from github, githubusercontent.com domains

Testing Strategy

• Test valid GitHub usernames (e.g., "octocat", "john-doe")
• Test invalid usernames (XSS attempts, special chars)
• Test emails with various formats
• Test XSS patterns in display names
• Test avatar URL validation
• Test length limits
• Test with null/undefined inputs

Files Modified

• Created: src/utils/inputValidation.js (comprehensive validation module)
• Modified: src/context/AuthContext.jsx (integrated validation into login)

Fixes #276

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ranker-hub	Error		Jun 5, 2026 4:21pm

[anshul23102]

Please add relevant labels:

• type/security
• severity/high
• area/authentication
• nsoc
• gssoc26

These help with tracking and prioritization. Thank you!

[anshul23102]

Suggested Labels

For maintainer review and categorization:

• security (Input validation/XSS prevention)
• frontend (Input validation)
• backend (Data validation)
• level:advanced (Advanced complexity)

Implements comprehensive input validation and sanitization to prevent stored XSS vulnerabilities.

[indresh404]

fix conflict

[anshul23102]

Hi @indresh404,

I've resolved the merge conflict in this PR. The conflict in src/context/AuthContext.jsx has been professionally addressed.

Resolution Strategy:
Instead of choosing one approach, I kept both imports to combine benefits:

• validateUserData: For comprehensive input validation and XSS prevention
• userDataCache & listenerOptimizer: For firestore performance optimization

Key Security Improvements Maintained:

• User data validation and sanitization before storage
• XSS attack prevention through input filtering
• Secure token handling (in-memory only, no localStorage/sessionStorage)
• Prevents malicious data corruption

Branch Status:

• Merge conflict resolved: ✅
• Both optimization and security features enabled: ✅
• Branch is up-to-date with main: ✅
• No functionality lost: ✅

The implementation now provides both security hardening AND performance optimization, ensuring the application is both fast and secure.

Closes #276

[indresh404]

If your PR still shows the old failed Vercel check, please rebase (or merge the latest main branch into your branch) and push again to trigger a fresh deployment/check run.