Summary

Reject invalid Minecraft usernames at the earliest VotingPlugin vote-ingress boundaries before any UUID generation or state mutation.

Valid Java Edition-style usernames continue to accept 1-16 ASCII letters, digits, and underscores, including previously unknown offline players and the exact 16-character value MchtNameOver16xx.

Root cause

Proxy offline mode resolved an offline UUID before validating the externally supplied Votifier username. Values containing traversal syntax, slashes, whitespace, punctuation, Unicode, controls, or more than 16 characters could therefore reach MySQL totals, vote caches, rewards, and backend/proxy forwarding.

Changes

• Add a central MinecraftUsernameValidator using [A-Za-z0-9_]{1,16}.
• Validate at the shared VotingPluginProxy.vote(...) boundary used by BungeeCord, Velocity, and multi-proxy vote replay.
• Validate standalone Bukkit Votifier events before service-site, queue, or PlayerVoteEvent processing.
• Sanitize and bound all rejected username/service values before logging.
• Sanitize the informational BungeeCord and Velocity Votifier receipt logs.
• Add regression coverage for invalid names and verify rejection happens before UUID lookup, totals/database access, vote-party/reward state, vote-cache access, backend messaging, or multi-proxy envelopes.
• Cover the 15-, 16-, and 17-character boundaries explicitly.

Validation

• git diff --check — passed.
• Validator compiled directly and smoke tests passed for valid 15/16-character names and invalid 17-character, traversal, slash, whitespace, Unicode, and control-character values.
• Full Maven tests could not be run in the available workspace because Maven and JDK 21 were unavailable.

MCHT follow-up

The MCHT harness is maintained outside this repository. Its invalid-length fixture must change from the valid 16-character MchtNameOver16xx to the genuine 17-character MchtNameOver16xxx before the next MCHT run.