fix(api): validate usernames in JSON routes

Author: eshaanag

app/api/github/route.test.ts

@@ -29,6 +29,15 @@ describe('GET /api/github', () => {
     expect(body.error).toContain('Invalid parameters');
   });
 
+  it('returns 400 and skips GitHub when username format is invalid', async () => {
+    const response = await GET(makeRequest({ username: 'bad user' }));
+    const body = await response.json();
+
+    expect(response.status).toBe(400);
+    expect(body.error).toContain('Invalid parameters');
+    expect(getFullDashboardData).not.toHaveBeenCalled();
+  });
+
   // Test 2 — valid username → 200
   it('returns 200 with JSON body for a valid username', async () => {
     vi.mocked(getFullDashboardData).mockResolvedValue({ profile: 'octocat' } as never);

app/api/stats/route.test.ts

@@ -55,6 +55,13 @@ describe('GET /api/stats', () => {
     expect(fetchGitHubContributions).not.toHaveBeenCalled();
   });
 
+  it('returns 400 and skips GitHub when the username format is invalid', async () => {
+    const response = await GET(makeRequest({ user: 'octo/cat' }));
+
+    expect(response.status).toBe(400);
+    expect(fetchGitHubContributions).not.toHaveBeenCalled();
+  });
+
   it('returns 400 for an unknown timezone', async () => {
     const response = await GET(makeRequest({ user: 'testuser', tz: 'Not/ATimezone' }));
     expect(response.status).toBe(400);

lib/validations.ts

@@ -58,13 +58,15 @@ function dimensionParam(name: string, min: number, max: number) {
     .transform(toDimensionValue);
 }
 
+const GITHUB_USERNAME_REGEX = /^[a-zA-Z0-9](?:[a-zA-Z0-9]|-(?=[a-zA-Z0-9]))*$/;
+
 export const streakParamsSchema = z.object({
   // Required — missing user surfaces as "Missing" to match existing tests
   user: z
     .string({ error: 'Missing user parameter' })
     .min(1, { message: 'Missing user parameter' })
     .max(39, { message: 'GitHub username cannot exceed 39 characters' })
-    .regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9]|-(?=[a-zA-Z0-9]))*$/, {
+    .regex(GITHUB_USERNAME_REGEX, {
       message: 'Invalid GitHub username',
     }),
 
@@ -218,7 +220,11 @@ export const streakParamsSchema = z.object({
 export const githubParamsSchema = z.object({
   username: z
     .string({ error: 'Missing "username" parameter' })
-    .min(1, { message: 'Username is required' }),
+    .min(1, { message: 'Username is required' })
+    .max(39, { message: 'GitHub username cannot exceed 39 characters' })
+    .regex(GITHUB_USERNAME_REGEX, {
+      message: 'Invalid GitHub username',
+    }),
   refresh: z.string().optional().transform(toRefreshFlag),
 });
 
@@ -258,7 +264,13 @@ export const ogParamsSchema = z
   }));
 
 export const statsParamsSchema = z.object({
-  user: z.string({ error: 'Missing user parameter' }).min(1, { message: 'Missing user parameter' }),
+  user: z
+    .string({ error: 'Missing user parameter' })
+    .min(1, { message: 'Missing user parameter' })
+    .max(39, { message: 'GitHub username cannot exceed 39 characters' })
+    .regex(GITHUB_USERNAME_REGEX, {
+      message: 'Invalid GitHub username',
+    }),
   refresh: z.string().optional().transform(toRefreshFlag),
   tz: z.string().optional(),
 });