Skip to content

bug: No input validation on user param invalid usernames cause unhandled errors instead of a graceful error SVG #870

Open
Open
bug: No input validation on user param invalid usernames cause unhandled errors instead of a graceful error SVG#870
Labels
GSSoC 2026bugSomething isn't workinggood first issueGood for newcomers
Milestone
GSSoC 2026

Description

@swati-204
swati-204
opened on May 28, 2026

Description

The /api/streak route accepts a user query parameter and passes it directly
to the GitHub GraphQL API without any prior validation. Invalid inputs (empty
strings, usernames with illegal characters, excessively long strings, or
non-existent users) result in either an unhandled runtime error or a broken/
blank SVG with no user-friendly feedback rendered in the badge itself.

Steps to Reproduce

  1. Visit https://commitpulse.vercel.app/api/streak?user= (empty)
  2. Visit https://commitpulse.vercel.app/api/streak?user=!!invalid!!
  3. Visit https://commitpulse.vercel.app/api/streak?user=this-user-does-not-exist-xyz-abc-123

Expected Behavior

A styled error SVG (matching the current theme) with a message
like "User not found" or "Invalid username".

Screenshots / Logs

Image

GitHub Username (If applicable)

user-123

Environment

Chrome

Metadata

Metadata

Assignees

No one assigned

    Labels

    GSSoC 2026bugSomething isn't workinggood first issueGood for newcomers

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions