1 files changed, 17 insertions, 2 deletions

diff --git a/src/routes/players.rs b/src/routes/players.rs
index 7cfb722..f90113a 100644
--- a/src/routes/players.rs
+++ b/src/routes/players.rs
@@ -9,6 +9,7 @@ use serde::Deserialize;
 
 use crate::auth::CurrentUser;
 use crate::routes::AppState;
+use crate::sanitize;
 
 #[derive(Template)]
 #[template(path = "players/manage.html")]
@@ -46,11 +47,14 @@ async fn manage_players(
 
     let (instance_name, whitelist, ops, bans) =
         if let Some((_id, inst_name, _rcon_pw, _container_state)) = active {
+            // Sanitize instance name to prevent path traversal in file reads
+            let safe_name = sanitize::sanitize_instance_name(&inst_name)
+                .unwrap_or_else(|| inst_name.clone());
             let data_dir = state
                 .config
                 .server_directory
                 .join("instances")
-                .join(&inst_name)
+                .join(&safe_name)
                 .join("data");
 
             let w = read_json_list(&data_dir.join("whitelist.json"));
@@ -92,9 +96,20 @@ macro_rules! player_action {
             CurrentUser(_user): CurrentUser,
             Form(form): Form<PlayerAction>,
         ) -> Result<Redirect, axum::response::Redirect> {
+            // Validate Minecraft username to prevent RCON command injection
+            // Minecraft usernames are 3-16 alphanumeric + underscore chars
+            let safe_username = form.username.trim();
+            if !sanitize::validate_username(safe_username) {
+                tracing::warn!(
+                    "Rejected invalid username for '{}': {safe_username:?}",
+                    stringify!($name)
+                );
+                return Ok(Redirect::to("/players"));
+            }
+
             if let Some((_, _, rcon_pw, _)) = get_active_instance(&state.db) {
                 let client = crate::rcon::RconClient::new(rcon_pw);
-                let cmd = format!($command, form.username);
+                let cmd = format!($command, safe_username);
                 match client.send_command_async(cmd.clone()).await {
                     Ok(resp) => tracing::info!("RCON '{}' -> {}", cmd, resp.trim()),
                     Err(e) => tracing::error!("RCON '{}' failed: {}", cmd, e),