Add Firebase validation rules and client-side guards for user name and avatar URL

[Copilot]

Users could write arbitrary strings as display names or any URL (including javascript:, http:, or malformed) as avatar URLs directly to the Realtime Database.

Firebase Database Rules (database.rules.json)

Field-level .validate rules added to users/$uid:

Field	Rule
name	Non-empty string, 1–64 chars, at least one non-whitespace character
photoURL	HTTPS-only URL (/^https:\/\/\S+/), max 500 chars; deletion allowed
uid	Must equal $uid (prevents spoofing)
search / language	Length-bounded strings
fcmToken / fcmTokens	Token strings and metadata validated
$other	false — blocks arbitrary field injection

"name": {
  ".validate": "newData.isString() && newData.val().length >= 1 && newData.val().length <= 64 && newData.val().matches(/\\S/)"
},
"photoURL": {
  ".validate": "newData.isString() && newData.val().length <= 500 && newData.val().matches(/^https:\\/\\/\\S+/)"
},
"$other": { ".validate": false }

Client-side (Profile.tsx)

• validateProfile() runs the same constraints before any Firebase write, surfacing a human-readable error inline
• Error clears on any field change
• maxLength attributes on inputs; photoURL placeholder updated to https://

CSS (Profile.css)

• .profile-error styled via --error-color CSS variable (fallback #d32f2f)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>users could set abusive names or avatar URLs </issue_title>
<issue_description>Add firebase protection </issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes users could set abusive names or avatar URLs  #195

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[github-actions]

PR Preview Action v1.8.1
🚀 View preview at https://ProLoser.github.io/PeaceInTheMiddleEast/preview/pr-196/
Built to branch gh-pages at 2026-03-27 20:23 UTC. Preview will be ready when the GitHub Pages deployment is complete.