Enhance GitHub Username Validation to Prevent GraphQL Injection Attacks

[anshul23102]

Enhance GitHub username validation to prevent GraphQL injection attacks and invalid API requests.

Fixes #8570

Problem

The API accepts GitHub username as a parameter without strict server-side validation before passing to GraphQL queries. While GraphQL variables are type-safe, defense-in-depth requires explicit validation.

Changes

• Updated username regex to explicit pattern matching GitHub's official rules
• Pattern: /^a-zA-Z0-9?$/
• Ensures usernames: start/end with alphanumeric, 1-39 chars, hyphens allowed in middle only
• Enhanced error messages explaining validation rules
• Applied validation across all API endpoints

Security Impact

• Prevents malicious username payloads from reaching GitHub API
• Returns clear 400 error for invalid usernames early
• Reduces unnecessary API calls
• Defense-in-depth approach complements GraphQL type safety

Implementation

Validation applied via to all badge endpoints and dashboard routes, ensuring consistent enforcement.

[vercel]

@anshul23102 is attempting to deploy a commit to the jhasourav07's projects Team on Vercel.

A member of the Team first needs to authorize it.

[retenta-bot]

This pull request enhances the validation of GitHub usernames to prevent potential GraphQL injection attacks, which is a crucial security improvement. It aligns with our previous decisions to enhance error handling and security measures in our GraphQL implementation. For instance, similar efforts were made in the past to handle nullable repository fields and improve rate limit handling. Thank you for your contribution to making our API more secure!

[anshul23102]

Hi @JhaSourav07,

Thank you for reviewing this security enhancement. This PR implements strict GitHub username validation to prevent GraphQL injection and invalid API requests.

The implementation:

• Uses explicit regex matching GitHub's official username rules
• Returns clear error messages for invalid usernames
• Applies consistent validation across all API endpoints
• Complements GraphQL's type safety with defense-in-depth validation

Suggested labels for better discovery and GSSoC recognition:

• gssoc-approved (priority)
• security
• input-validation
• bug-fix
• GSSoC 2026

Looking forward to your review of this security improvement.

Best regards,
Anshul

[github-actions]

🚨 Hey @anshul23102, the CI Pipeline is failing on this PR and it has been marked as status:blocked.

Please fix the issues before this can be reviewed. Here's how:

1. Run checks locally before pushing:

npm run format:check   # Check Prettier formatting
npm run lint           # Run ESLint
npm run typecheck      # TypeScript type check
npm run test           # Run unit tests (Vitest)
npm run build          # Verify production build passes

2. Auto-fix common issues:

npm run format         # Auto-fix formatting with Prettier
npm run lint -- --fix  # Auto-fix lint errors where possible

3. Check the full failure log here:
👉 View CI Run

Once you push a fix and the CI passes, the status:blocked label will be removed automatically. 💪

[Aamod007]

[Review comment removed as per updated policy.]

[Aamod007]

Update: We are waiving the single-commit/formatting requirement for now. Approved! ✅

Dismissing to clear the requested changes state.

[github-actions]

⚠️ Hey @anshul23102, this pull request has been inactive for 3 days. It will be automatically closed in 2 days if no further activity occurs.

If you are still working on this, please push your latest changes or leave a comment to keep it active.

[Aamod007]

Good catch on the regex logic. Ensuring usernames strictly adhere to GitHub's constraints prevents malformed requests and adds a solid layer of defense-in-depth against potential injection vectors. The clearer error messages are also a great UX improvement. Approved!

[github-actions]

🤖 Hey @anshul23102, this pull request has been automatically closed because it has been inactive for 5 days.

Why was this PR closed?
To keep the repository manageable, we automatically close pull requests that have had no activity for 5 days.

How to reopen this PR:

1. Pull the latest changes from the upstream repository
2. Resolve any merge conflicts
3. Address any review feedback
4. Push your changes to your branch
5. Reopen this PR by commenting /reopen or creating a new PR

We appreciate your contribution and would love to review your work when it's ready! Thank you! ❤️

[JhaSourav07]

check for ci failure please and fix it so that i can merge it
@anshul23102