Page MenuHomePhabricator

AntiSpoof extension gives incorrect results when a requested username contains some special characters
Closed, ResolvedPublic

Description

Sometimes when a requested username contains some special characters (?) the AntiSpoof extension gives a nonsense result.

I've seen this happened at least few times.
And for the record, the requested username had nothing similar with the "username" mentioned by the extension below.

The chosen username is similar to existing usernames: ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! !!, ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! !", ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! !$, ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! !%, ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! !&


Sometimes Antispoof shows strange propositions which don't correspond to the wanted username. Everytime it shows ! ! ! ! !-based propositions.

Example:
Jeffxxx is requesting a rename to 134235629345692348.
https://meta.wikimedia.org/wiki/Special:GlobalRenameQueue/request/34454
Links on The chosen username is similar to existing usernames (globalrenamequeue-request-antispoof-conflicts message): 1, 2, 3..

{F8679640}

Event Timeline

Stryn raised the priority of this task from to Needs Triage.
Stryn updated the task description. (Show Details)
Stryn added projects: AntiSpoof, GlobalRename.
Stryn subscribed.

Could you provide with an example of such a username where this has occurred?

Could you provide with an example of such a username where this has occurred?

Currently open request https://meta.wikimedia.org/wiki/Special:GlobalRenameQueue/request/16067
Requested username: ー¥----

Ok, I did some testing, and it seems that you get this nonsense string when the requested username is something like "- - - -" or ". . . ."

Applies also for random number series like 4643643743743.

Looks like mNormalized is null for this type of usernames in SpoofUser. So in the conflict checking query for usernames like this, it looks for rows where su_normalized is null. Since su_normalized is also null for non-legal usernames, it returns usernames that are not related. Perhaps we shouldn't show any conflicts for non-legal usernames at all?

It is allowed to rename such accounts or not?

In both cases (yes or no) the warning needs a fix.

It is allowed to rename such accounts or not?

I don't think it would be disallowed but I would advise against doing such renames because it would cause addition of more entries where AntiSpoof will not work properly.

I think we should show another warning message when it's null discouraging to perform the rename. That is probably better than not showing the warning at all. Does that sound fine?

Still getting these nonsense "similar usernames".

Can we agree on a proper solution so that this can be fixed?

Change 956085 had a related patch set uploaded (by Umherirrender; author: Umherirrender):

[mediawiki/extensions/AntiSpoof@master] Do not lookup conflicts for non-legal user names

https://gerrit.wikimedia.org/r/956085

Change 956085 merged by jenkins-bot:

[mediawiki/extensions/AntiSpoof@master] Do not lookup conflicts for non-legal user names

https://gerrit.wikimedia.org/r/956085