A user, twofoursixeight, reported an issue where any Unicode character, except spaces, can be exploited into a username. This can cause a profile to become unclickable if shared in the same forum. However, sam explained that this is by design due to the default off site setting for Unicode usernames. gerhard thanked the user for reporting the issue and recommended configuring the allowed unicode username characters site setting to prevent such issues. Despite this, gerhard created a fix to prevent the usage of invisible characters in usernames, which can be found in this pull request.
Hello. I have seen an issue where you can exploit any Unicode character except for spaces into your username. I have created a test account to showcase this.
https://meta.discourse.org/u/%E3%85%A4%E3%85%A4%E3%85%A4/summary
Furthermore, if you share the same forum, the profile becomes unclickable.
link to profile
This is by design due to the default off site setting:
We disable this by default cause of this exact vector.
Oh … this is super nice:
Thanks for reporting that issue.
The unicode usernames site setting is off by default and we recommend configuring the allowed unicode username characters site setting in order to prevent issues like these, so this isn’t a huge issue (see Unicode usernames and group names).
Still, I’ve created a fix which will always prevent the usage of invisible characters in usernames even for those who haven’t configured the allowlist.
This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.
