fedserv/echo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

nickserv/chanserv: reject look-alike / mixed-script registration names (homoglyph impersonation guard)
All checks were successful
CI / check (push) Successful in 3m56s
Details

Browse source
This commit is contained in:
Jean Chevronnet 2026-07-19 00:02:44 +00:00
parent 03f9c2d3bd
commit c2b70f5004
No known key found for this signature in database
3 changed files with 110 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
modules/chanserv/src/lib.rs
View file

@ -131,6 +131,12 @@ impl Service for ChanServ {
ctx.notice(me, from.uid, format!("\x02{chan}\x02 can't be registered: {reason}"));
return;
}
// Refuse a look-alike / mixed-script channel name (e.g. a Cyrillic
// homoglyph of a real channel).
if let Some(reason) = echo_api::confusable_reason(chan) {
ctx.notice(me, from.uid, reason);
return;
}
match db.register_channel(chan, account) {
Ok(()) => {
ctx.channel_mode(me, chan, "+r"); // mark the channel registered

5
modules/nickserv/src/register.rs
View file

@ -12,6 +12,11 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx) {
ctx.notice(me, from.uid, reason);
return;
}
// Refuse a look-alike / mixed-script nick before it can be used to impersonate.
if let Some(reason) = echo_api::confusable_reason(from.nick) {
ctx.notice(me, from.uid, reason);
return;
}
let email = args.get(2).map(|s| s.to_string());
ctx.defer_register(from.nick, *password, email, RegReply::NickServ {
agent: me.to_string(),