good first issuesecurity/abuse
Metriche repository
- Star
- (16 stelle)
- Metriche merge PR
- (Metriche PR in attesa)
Descrizione
Add a username_typosquat field to the account table, which contains the username with all punctuation removed. Enforce uniqueness on this field. This ensures that if I am Alexander Hamilton, and I claim the alexanderhamilton username, nobody can pseudo-snipe me by grabbing alexander-hamilton. Might want to also harden against a1exanderhamilton by replacing 1 with l for the typosquat field. I don't think we need to worry about 0 and O, because we enforce usernames to be all-lowercase, hard to confuse 0 and o.
Brought to my attention by http://blog.npmjs.org/post/168978377570/new-package-moniker-rules?utm_content=buffer646e8&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer