[Crash] Unchecked msg.username.length access in validateRegister

[coderabbitai]

Summary

Server crashes when msg.username is undefined/null but code accesses msg.username.length.

Affected Code

server-services/start-services.js:517

case 'validateRegister':
  if (msg.username.length < 3 || !/^[A-Za-z0-9?!._-]+$/.test(msg.username)) {
    // CRASH if msg.username is undefined

Vulnerability

If a client sends {"cmd":"validateRegister"} without a username field, msg.username is undefined.

Impact

• Remote server crash with single message
• Denial of service

Proof of Concept

{"cmd":"validateRegister","password":"abc123"}

Recommended Fix

if (!msg.username || msg.username.length < 3 || !/^[A-Za-z0-9?!._-]+$/.test(msg.username)) {

References

• PR: New Blocks & Ported fancyMuzzle flash #43