Skip to content

Conversation

@eviljeff
Copy link
Member

@eviljeff eviljeff commented Oct 31, 2025

Fixes: mozilla/addons#15875

Description

Add homoglyph expansion to DeniedName checks used by Collection name, slug, and UserProfile display name. Needed some reworking of how matches to DeniedNames worked now we aren't doing a single check per field.

Context

Prior to the second commit, DeniedName.blocked executed a query each time it was called so it really (really) did not scale up to 65k iterations with homoglyphs. (A single test for l * 16 was taking 90s locally). The python x in y string test is not as loose as the mysql query - the collation used specifically ignored accent characters and case - but my thinking was the homoglyph expansion would effectively do the same thing. (... not a completely proven hypothesis ...)

Testing

  • add some DeniedName instances in django admin (if you use django shell, you need to be careful to use lower case)
  • make a change to your display name via frontend that contains one of the denied names - see it's blocked
  • add a string with 16+ possible homoglyphs - e.g. l more than 16 times.
  • (change it to something innocuous to check for regressions)
  • repeat with a collection name and slug
  • (collections should allow the DeniedName check to be bypassed when you have Collections:Edit; collection slugs have further restrictions on allowed characters)

Checklist

  • Add #ISSUENUM at the top of your PR to an existing open issue in the mozilla/addons repository.
  • Successfully verified the change locally.
  • The change is covered by automated tests, or otherwise indicated why doing so is unnecessary/impossible.
  • Add before and after screenshots (Only for changes that impact the UI).
  • Add or update relevant docs reflecting the changes made.

@eviljeff eviljeff changed the title expand homoglyph protection to UserProfile.display_name and Collectio… expand homoglyph protection to UserProfile.display_name and Collection.name Oct 31, 2025
@eviljeff eviljeff force-pushed the 15875-enhanced-name-validation-for-users-and-collections branch from c514bee to fb0d09d Compare October 31, 2025 14:51
@eviljeff eviljeff force-pushed the 15875-enhanced-name-validation-for-users-and-collections branch from fb0d09d to 1e840dc Compare October 31, 2025 15:19
@eviljeff eviljeff requested a review from willdurand October 31, 2025 15:21
@eviljeff eviljeff marked this pull request as ready for review November 5, 2025 14:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Task]: Apply add-on name validation to users & collection names

1 participant