mytakedotorg/mtdo

Harden against "typosquatting"

Open

#136 opened on Dec 28, 2017

View on GitHubContributor guide
 (0 comments) (0 reactions) (0 assignees)Java (3 forks)auto 404
good first issuesecurity/abuse

Repository metrics

Stars
 (16 stars)
PR merge metrics
 (PR metrics pending)

Description

Add a username_typosquat field to the account table, which contains the username with all punctuation removed. Enforce uniqueness on this field. This ensures that if I am Alexander Hamilton, and I claim the alexanderhamilton username, nobody can pseudo-snipe me by grabbing alexander-hamilton. Might want to also harden against a1exanderhamilton by replacing 1 with l for the typosquat field. I don't think we need to worry about 0 and O, because we enforce usernames to be all-lowercase, hard to confuse 0 and o.

Brought to my attention by http://blog.npmjs.org/post/168978377570/new-package-moniker-rules?utm_content=buffer646e8&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer

Contributor guide

Research direction
Study the account table schema and implement a new column with unique constraint, then add logic to generate the typosquat field from username.
Tech stack
java
Domain
backend
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
JavaGit
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
75