matrix/matrix-js-sdk
1
0
Fork 0
mirror of https://github.com/matrix-org/matrix-js-sdk.git synced 2025-11-25 05:23:13 +03:00
Code Activity

take into account homoglyphs when calculating similar display names

Browse Source 
to prevent homoglyph attacks

Signed-off-by: Michael Telatynski <7t3chguy@gmail.com>
This commit is contained in:
Michael Telatynski
2018-07-26 14:50:55 +01:00
parent 2613690064
commit b34716f7e9
2 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
package.json
View File

@@ -54,7 +54,8 @@
"bluebird": "^3.5.0", "bluebird": "^3.5.0",
"browser-request": "^0.3.3", "browser-request": "^0.3.3",
"content-type": "^1.0.2", "content-type": "^1.0.2",
"request": "^2.53.0" "request": "^2.53.0",
"unhomoglyph": "^1.0.2"
}, },
"devDependencies": { "devDependencies": {
"babel-cli": "^6.18.0", "babel-cli": "^6.18.0",

5
src/utils.js
View File

@@ -19,6 +19,8 @@ limitations under the License.
* @module utils * @module utils
*/ */
const unhomoglyph = require('unhomoglyph');
/** /**
* Encode a dictionary of query parameters. * Encode a dictionary of query parameters.
* @param {Object} params A dict of key/values to encode e.g. * @param {Object} params A dict of key/values to encode e.g.
@@ -665,10 +667,11 @@ module.exports.isNumber = function(value) {
/** /**
* Removes zero width chars, diacritics and whitespace from the string * Removes zero width chars, diacritics and whitespace from the string
* Also applies an unhomoglyph on the string, to prevent similar looking chars
* @param {string} str the string to remove hidden characters from * @param {string} str the string to remove hidden characters from
* @return {string} a string with the hidden characters removed * @return {string} a string with the hidden characters removed
*/ */
module.exports.removeHiddenChars = function(str) { module.exports.removeHiddenChars = function(str) {
return str.normalize('NFD').replace(removeHiddenCharsRegex, ''); return unhomoglyph(str.normalize('NFD').replace(removeHiddenCharsRegex, ''));
}; };
const removeHiddenCharsRegex = /[\u200B-\u200D\u0300-\u036f\uFEFF\s]/g; const removeHiddenCharsRegex = /[\u200B-\u200D\u0300-\u036f\uFEFF\s]/g;