This was originally reported as a private security issue, but has been approved for handling in the public queue by the Drupal Security Team.

Background information

Problem/Motivation

Similar letters from other alphabets can be used to bypass username restrictions.
For example if the module is configured to disallow the "admin", it is still possible to use a Cyrillic A instead (аdmin).

There is also a core issue about this: #85826: Prevent homographic usernames

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

prudloff created an issue. See original summary.

avpaderno’s picture

I have not yet created an issue fork for this issue because, the more I think about it, the more I think that any change done in #85826: Prevent homographic usernames would fix this issue too. That is because usernames that are not allowed by Drupal core cannot be made possible by the User Restrictions module, except in the case this module removes all the constraints added by Drupal core, which is not what this module should do.

This is really true also for not homographic characters: Drupal core does not allow a username that starts with a space, ends with a space, nor a username that contains two spaces in row. This module cannot allow those usernames, but the module does not give a warning for regular expressions that allow a space at the beginning of a username.
This means that the module should not give any warning for regular expressions that allow homographic characters. It should either apply the regular expressions entered by people without making any change to the regular expressions nor to the value used by those regular expressions to check the entered username or use the transliterated username as value the regular expressions need to check.

avpaderno’s picture

Version: 3.0.x-dev » 4.0.x-dev
avpaderno’s picture

Title: Prevent homographic usernames » Allow regular expressions used in user restrictions to match homographic characters

I changed the title because, more than preventing usernames which contains homographic characters, which is a task for Drupal core, this module should allow the regular expressions to match also homographic characters.

avpaderno’s picture

Furthermore, allowing a regular expression to match homographic characters should be done for usernames, but also for other fields which allow entering Unicode characters.

avpaderno’s picture

Status: Active » Needs review

  • avpaderno committed f7f746f4 on 4.0.x
    Issue #3583321: Allow regular expressions used in user restrictions to...

  • avpaderno committed 4574e7cc on main
    Issue #3583321: Allow regular expressions used in user restrictions to...
avpaderno’s picture

Version: 4.0.x-dev » 3.0.x-dev

  • avpaderno committed 04504aa0 on 3.0.x
    Issue #3583321: Allow regular expressions used in user restrictions to...
avpaderno’s picture

Status: Needs review » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.