MBS-13857 / MBS-13893: Block invisible characters from usernames #3444
+45
−4
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Invisible characters are problematic in usernames, since they make it easy to pose as someone else. While there can be cases where these characters could make sense elsewhere, in usernames we should play it a bit safer. As such, this creates a separate sanitize_username method that can call further cleanups on top of the basic sanitize, and runs the pre-existing remove_invisible_characters in it.
These can be used for flag emojis, which can have their place on entity names, annotations and the like. But they can (and have been) also be used as invisible characters to create seemingly-duplicate usernames, which is gaming the project. The downside seems higher than the dubious benefit of emoji flags in usernames, so this blocks their use there. In any case, it seems most emoji flags use regional indicator symbols instead.
mwiencek
approved these changes
Jan 9, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Implement MBS-13857 / MBS-13893
Problem
There's recently been a bunch of abusive character creation involving the use of unicode tag characters to create multiple accounts with visually the same name. Additionally, we have blocked some other invisible characters from edit notes, but we still allow them in usernames - these can have the same effect.
Solution
This moves from simply using
sanitizeto block invalid characters in names to a newsanitize_usernamemethod, that also runs the pre-existing methodremove_invisible_charactersand a newremove_tag_charactersmethod on the username on top ofsanitize.Testing
Two tests (one per commit / set of characters) have been added to the
User::Registertest.