github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-06-07 16:04:39 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

FIX: Disallow invisible Unicode characters in usernames (#21331)

Browse Source 
The list of excluded characters is based on https://invisible-characters.com/ and the list of invisible characters used by Visual Studio Code (https://github.com/hediet/vscode-unicode-data)
This commit is contained in:
Gerhard Schlager
2023-05-02 09:34:53 +02:00
committed by GitHub
parent c63551d227
commit 01dc461cc2
2 changed files with 48 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
app/models/username_validator.rb
View File

@ -44,7 +44,34 @@ class UsernameValidator
MAX_CHARS ||= 60
ASCII_INVALID_CHAR_PATTERN ||= /[^\w.-]/
UNICODE_INVALID_CHAR_PATTERN ||= /[^\p{Alnum}\p{M}._-]/
# All Unicode characters except for alphabetic and numeric character, marks and underscores are invalid.
# In addition to that, the following letters and nonspacing marks are invalid:
# (U+034F) Combining Grapheme Joiner
# (U+115F) Hangul Choseong Filler
# (U+1160) Hangul Jungseong Filler
# (U+17B4) Khmer Vowel Inherent Aq
# (U+17B5) Khmer Vowel Inherent Aa
# (U+180B - U+180D) Mongolian Free Variation Selectors
# (U+3164) Hangul Filler
# (U+FFA0) Halfwidth Hangul Filler
# (U+FE00 - U+FE0F) "Variation Selectors" block
# (U+E0100 - U+E01EF) "Variation Selectors Supplement" block
UNICODE_INVALID_CHAR_PATTERN ||=
/
[^\p{Alnum}\p{M}._-]|
[
\u{034F}
\u{115F}
\u{1160}
\u{17B4}
\u{17B5}
\u{180B}-\u{180D}
\u{3164}
\u{FFA0}
\p{In Variation Selectors}
\p{In Variation Selectors Supplement}
]
/x
INVALID_LEADING_CHAR_PATTERN ||= /\A[^\p{Alnum}\p{M}_]+/
INVALID_TRAILING_CHAR_PATTERN ||= /[^\p{Alnum}\p{M}]+\z/
REPEATED_SPECIAL_CHAR_PATTERN ||= /[-_.]{2,}/