From c8d5128b0c263886f3be371c29db7c8e3df25a6c Mon Sep 17 00:00:00 2001
From: Paul Makles <me@insrt.uk>
Date: Sun, 11 Jun 2023 12:26:18 +0100
Subject: [PATCH] chore: add additional sanitisation

---
 Cargo.lock                                  | 7 +++++++
 crates/quark/Cargo.toml                     | 1 +
 crates/quark/src/impl/generic/users/user.rs | 5 +++++
 crates/quark/src/util/manipulation.rs       | 2 +-
 4 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/Cargo.lock b/Cargo.lock
index 5287c260..1fd7f416 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -806,6 +806,12 @@ dependencies = [
  "uuid",
 ]
 
+[[package]]
+name = "decancer"
+version = "1.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "808127a7de612079ec37bfc1abc48ed77a6015a971a8bd7d4178d79147cbc839"
+
 [[package]]
 name = "derivative"
 version = "2.2.0"
@@ -2974,6 +2980,7 @@ dependencies = [
  "bson",
  "dashmap",
  "deadqueue",
+ "decancer",
  "dotenv",
  "futures",
  "impl_ops",
diff --git a/crates/quark/Cargo.toml b/crates/quark/Cargo.toml
index 97df955d..76902a57 100644
--- a/crates/quark/Cargo.toml
+++ b/crates/quark/Cargo.toml
@@ -64,6 +64,7 @@ nanoid = "0.4.0"
 linkify = "0.8.1"
 dotenv = "0.15.0"
 indexmap = "1.9.1"
+decancer = "1.6.2"
 impl_ops = "0.1.1"
 num_enum = "0.5.6"
 reqwest = "0.11.10"
diff --git a/crates/quark/src/impl/generic/users/user.rs b/crates/quark/src/impl/generic/users/user.rs
index 98c1af06..2735ebdd 100644
--- a/crates/quark/src/impl/generic/users/user.rs
+++ b/crates/quark/src/impl/generic/users/user.rs
@@ -177,6 +177,11 @@ impl User {
         // Copy the username for validation
         let username_lowercase = username.to_lowercase();
 
+        // Block homoglyphs
+        if decancer::cure(&username_lowercase).into_str() != username_lowercase {
+            return Err(Error::InvalidUsername);
+        }
+
         // Ensure the username itself isn't blocked
         const BLOCKED_USERNAMES: &[&str] = &["admin", "revolt"];
 
diff --git a/crates/quark/src/util/manipulation.rs b/crates/quark/src/util/manipulation.rs
index dba7f3f5..16f7913d 100644
--- a/crates/quark/src/util/manipulation.rs
+++ b/crates/quark/src/util/manipulation.rs
@@ -8,6 +8,6 @@ pub fn prefix_keys<T: Serialize>(t: &T, prefix: &str) -> HashMap<String, serde_j
     let v: HashMap<String, serde_json::Value> = serde_json::from_str(&v).unwrap();
     v.into_iter()
         .filter(|(_k, v)| !v.is_null())
-        .map(|(k, v)| (prefix.to_owned() + &k, v))
+        .map(|(k, v)| (format!("{}{}", prefix.to_owned(), k), v))
         .collect()
 }