fix: stricter regex for username search

src/commands/searchplayers.ts

@@ -2,6 +2,7 @@ import { SlashCommandBuilder } from 'discord.js';
 import markdownEscape from 'markdown-escape';
 import { BLITZ_SERVERS, BlitzServer } from '../constants/servers.js';
 import getWargamingResponse from '../core/blitz/getWargamingResponse.js';
+import { usernameRegex } from '../core/blitz/listAccountsPanServer.js';
 import cmdName from '../core/interaction/cmdName.js';
 import infoEmbed from '../core/interaction/infoEmbed.js';
 import addServerChoices from '../core/options/addServerChoices.js';
@@ -34,13 +35,14 @@ export default {
     const server = interaction.options.getString('server') as BlitzServer;
     const name = interaction.options.getString('username')!;
     const limit = interaction.options.getInteger('limit') ?? 25;
-    const normalizedSearch = encodeURIComponent(name.trim());
+    const trimmedSearch = name.trim();
-    const players =
+    const players = usernameRegex.test(trimmedSearch)
-      normalizedSearch.length >= 3 && normalizedSearch.length <= 100
+      ? await getWargamingResponse<AccountList>(
-        ? await getWargamingResponse<AccountList>(
+          `https://api.wotblitz.${server}/wotb/account/list/?application_id=${
-            `https://api.wotblitz.${server}/wotb/account/list/?application_id=${args['wargaming-application-id']}&search=${normalizedSearch}&limit=${limit}`,
+            args['wargaming-application-id']
-          )
+          }&search=${encodeURIComponent(trimmedSearch)}&limit=${limit}`,
-        : [];
+        )
+      : [];
 
     await interaction.editReply({
       embeds: [

src/core/blitz/listAccountsPanServer.ts

@@ -7,15 +7,18 @@ export type AccountListWithServer = (Account & {
   server: 'com' | 'eu' | 'asia';
 })[];
 
-export default async function listAccountsPanServer(search: string, limit = 9) {
+export const usernameRegex = /^[a-zA-Z0-9_]{3,24}$/;
-  const normalizedSearch = encodeURIComponent(search.trim());
-  const normalizedLimit = Math.round(limit / 3);
 
-  if (normalizedSearch.length >= 3 && normalizedSearch.length <= 100) {
+export default async function listAccountsPanServer(search: string, limit = 9) {
+  const trimmedSearch = search.trim();
+  const normalizedLimit = Math.round(limit / 3);
+  const encodedSearch = encodeURIComponent(trimmedSearch);
+
+  if (usernameRegex.test(trimmedSearch)) {
     return (
       await Promise.all([
         getWargamingResponse<AccountList>(
-          `https://api.wotblitz.com/wotb/account/list/?application_id=${args['wargaming-application-id']}&search=${search}&limit=${normalizedLimit}`,
+          `https://api.wotblitz.com/wotb/account/list/?application_id=${args['wargaming-application-id']}&search=${encodedSearch}&limit=${normalizedLimit}`,
         ).then(
           (value) =>
             value &&
@@ -25,7 +28,7 @@ export default async function listAccountsPanServer(search: string, limit = 9) {
             })),
         ),
         getWargamingResponse<AccountList>(
-          `https://api.wotblitz.eu/wotb/account/list/?application_id=${args['wargaming-application-id']}&search=${search}&limit=${normalizedLimit}`,
+          `https://api.wotblitz.eu/wotb/account/list/?application_id=${args['wargaming-application-id']}&search=${encodedSearch}&limit=${normalizedLimit}`,
         ).then(
           (value) =>
             value &&
@@ -35,7 +38,7 @@ export default async function listAccountsPanServer(search: string, limit = 9) {
             })),
         ),
         getWargamingResponse<AccountList>(
-          `https://api.wotblitz.asia/wotb/account/list/?application_id=${args['wargaming-application-id']}&search=${search}&limit=${normalizedLimit}`,
+          `https://api.wotblitz.asia/wotb/account/list/?application_id=${args['wargaming-application-id']}&search=${encodedSearch}&limit=${normalizedLimit}`,
         ).then(
           (value) =>
             value &&