Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implements SMF\Unicode\SpoofDectector #8202

Merged

Conversation

Sesquipedalian
Copy link
Member

@Sesquipedalian Sesquipedalian commented May 7, 2024

Detects and prevents the use of Unicode character spoofing to cause mischief.

There are two main features of this PR:

  1. It ensures character spoofing cannot be used to create visually confusable names. For example, if an existing member has the display name "Bob" (Latin letter o), this code will prevent another member from using the display name "Bοb" (Greek letter omicron).
  2. It detects and prevent attempts to bypass the word censor via character spoofing. For example, if "quack" (Latin letter a) is censored, also censor "quack" (Cyrillic letter a).

Spoof detection in display names is always enabled. Spoof detection in the word censor is controlled by a new "Detect character spoofing when censoring" setting, which is enabled by default upon installing or upgrading.

To enable efficient checks for display names, a new column has been added to the members table that stores the "spoofdetector_name" of the member, which is a version of their display name that has been run through the "Confusable Detection" algorithm defined in UTS #39, section 4.

The SMF\Tasks\UpdateUnicode background task has been expanded to fetch updates to the official list of confusable characters and related files. It then compiles the confusables data into a PHP data file in SMF\Unicode\Confusables.php. Finally, it spawns a second task, SMF\Tasks\UpdateSpoofDetectorNames, which takes care of updating the "spoofdetector_name" for each member.

@Sesquipedalian Sesquipedalian merged commit 654f791 into SimpleMachines:release-3.0 May 14, 2024
6 checks passed
@Sesquipedalian Sesquipedalian deleted the spoofdetector branch May 14, 2024 21:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant