website/views/user.py (1)

61-92: Validate GitHub host before deriving avatar handles

Right now any URL containing a slash (e.g., Twitter, LinkedIn, company blogs) passes through and we emit https://github.com/<last-segment>.png, which produces broken or misleading avatars. Previously those entries fell back to Gravatar, so this regresses the display. Please bail out unless the netloc is really GitHub (include www./api. variants) before we lift the final path component. Remember to add the urlparse import alongside the existing ones.

+from urllib.parse import urlparse
+
 def extract_github_username(github_url):
@@
-    # Strip trailing slashes and whitespace
-    github_url = github_url.strip().rstrip("/")  # Clean URL format
-
-    # Remove query parameters and fragments if present
-    github_url = github_url.split("?")[0].split("#")[0]
-
-    # Ensure URL contains at least one slash
-    if "/" not in github_url:
-        return None
-
-    # Split on "/" and get the last segment
-    segments = github_url.split("/")
-    username = segments[-1] if segments else None
-
-    # Return username only if it's non-empty and not domain parts or protocol prefixes
-    if username and username not in ["github.com", "www.github.com", "www", "http:", "https:"]:
-        return username
-
-    return None
+    parsed = urlparse(github_url.strip())
+    if parsed.netloc.lower() not in {"github.com", "www.github.com", "api.github.com"}:
+        return None
+
+    path_segments = [segment for segment in parsed.path.split("/") if segment]
+    if not path_segments:
+        return None
+
+    username = path_segments[-1]
+    if username in {"apps", "users", "orgs"}:
+        return None
+
+    return username

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting