From 6c28e066cda36da9b2192fa88a68469db4cce1ef Mon Sep 17 00:00:00 2001
From: trevor-signal <131492920+trevor-signal@users.noreply.github.com>
Date: Thu, 12 Mar 2026 12:38:14 -0400
Subject: [PATCH] Improve username validity checks

---
 ts/models/conversations.preload.ts      | 11 +++++++++++
 ts/services/backups/export.preload.ts   |  2 +-
 ts/services/storageRecordOps.preload.ts |  4 ++--
 3 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/ts/models/conversations.preload.ts b/ts/models/conversations.preload.ts
index 5d35f8a1f0..108fbffde9 100644
--- a/ts/models/conversations.preload.ts
+++ b/ts/models/conversations.preload.ts
@@ -267,6 +267,7 @@ import { maybeNotify } from '../messages/maybeNotify.preload.js';
 import { missingCaseError } from '../util/missingCaseError.std.js';
 import * as Message from '../types/Message2.preload.js';
 import { itemStorage } from '../textsecure/Storage.preload.js';
+import { isUsernameValid } from '../util/Username.dom.js';
 
 const { compact, isNumber, throttle, debounce } = lodash;
 
@@ -4454,6 +4455,16 @@ export class ConversationModel {
       return;
     }
 
+    if (username && !isUsernameValid(username)) {
+      log.error(
+        `updateUsername(${this.idForLogging()}): username is invalid, dropping`,
+        {
+          fromStorageService,
+        }
+      );
+      return;
+    }
+
     log.info(`updateUsername(${this.idForLogging()}): updating username`);
 
     this.#doSet({ username });
diff --git a/ts/services/backups/export.preload.ts b/ts/services/backups/export.preload.ts
index e16fa99c4e..345dedd0a0 100644
--- a/ts/services/backups/export.preload.ts
+++ b/ts/services/backups/export.preload.ts
@@ -1259,7 +1259,7 @@ export class BackupExportStream extends Readable {
             aci,
             pni,
             e164,
-            username: convo.username ?? null,
+            username: convo.username || null,
             blocked: convo.serviceId
               ? itemStorage.blocked.isServiceIdBlocked(convo.serviceId)
               : null,
diff --git a/ts/services/storageRecordOps.preload.ts b/ts/services/storageRecordOps.preload.ts
index 8648a067f6..ddd3e7b424 100644
--- a/ts/services/storageRecordOps.preload.ts
+++ b/ts/services/storageRecordOps.preload.ts
@@ -1378,7 +1378,7 @@ export async function mergeContactRecord(
     };
   }
 
-  await conversation.updateUsername(dropNull(contactRecord.username), {
+  await conversation.updateUsername(dropNull(contactRecord.username || null), {
     shouldSave: false,
     fromStorageService: true,
   });
@@ -1986,7 +1986,7 @@ export async function mergeAccountRecord(
     needsStorageServiceSync: false,
   });
 
-  await conversation.updateUsername(dropNull(username), {
+  await conversation.updateUsername(dropNull(username || null), {
     shouldSave: false,
     fromStorageService: true,
   });