Sanitize multiple spaces in display names to protect against some security concerns (#5703)

src/lib/strings/display-names.ts

@@ -7,6 +7,7 @@ import {ModerationUI} from '@atproto/api'
 const CHECK_MARKS_RE = /[\u2705\u2713\u2714\u2611]/gu
 const CONTROL_CHARS_RE =
   /[\u0000-\u001F\u007F-\u009F\u061C\u200E\u200F\u202A-\u202E\u2066-\u2069]/g
+const MULTIPLE_SPACES_RE = /[\s][\s]+/g
 
 export function sanitizeDisplayName(
   str: string,
@@ -16,7 +17,11 @@ export function sanitizeDisplayName(
     return ''
   }
   if (typeof str === 'string') {
-    return str.replace(CHECK_MARKS_RE, '').replace(CONTROL_CHARS_RE, '').trim()
+    return str
+      .replace(CHECK_MARKS_RE, '')
+      .replace(CONTROL_CHARS_RE, '')
+      .replace(MULTIPLE_SPACES_RE, ' ')
+      .trim()
   }
   return ''
 }