chore: add additional sanitisation

Cargo.lock

@@ -806,6 +806,12 @@ dependencies = [
  "uuid",
 ]
 
+[[package]]
+name = "decancer"
+version = "1.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "808127a7de612079ec37bfc1abc48ed77a6015a971a8bd7d4178d79147cbc839"
+
 [[package]]
 name = "derivative"
 version = "2.2.0"
@@ -2837,7 +2843,7 @@ dependencies = [
 
 [[package]]
 name = "revolt-bonfire"
-version = "0.6.0"
+version = "0.6.1"
 dependencies = [
  "async-std",
  "async-tungstenite",
@@ -2854,7 +2860,7 @@ dependencies = [
 
 [[package]]
 name = "revolt-database"
-version = "0.6.0"
+version = "0.6.1"
 dependencies = [
  "async-recursion",
  "async-std",
@@ -2885,7 +2891,7 @@ dependencies = [
 
 [[package]]
 name = "revolt-delta"
-version = "0.6.0"
+version = "0.6.1"
 dependencies = [
  "async-channel",
  "async-std",
@@ -2925,7 +2931,7 @@ dependencies = [
 
 [[package]]
 name = "revolt-models"
-version = "0.6.0"
+version = "0.6.1"
 dependencies = [
  "revolt-permissions",
  "revolt_optional_struct",
@@ -2936,7 +2942,7 @@ dependencies = [
 
 [[package]]
 name = "revolt-permissions"
-version = "0.6.0"
+version = "0.6.1"
 dependencies = [
  "async-std",
  "async-trait",
@@ -2950,7 +2956,7 @@ dependencies = [
 
 [[package]]
 name = "revolt-presence"
-version = "0.6.0"
+version = "0.6.1"
 dependencies = [
  "async-std",
  "log",
@@ -2961,7 +2967,7 @@ dependencies = [
 
 [[package]]
 name = "revolt-quark"
-version = "0.6.0"
+version = "0.6.1"
 dependencies = [
  "async-lock",
  "async-recursion",
@@ -2974,6 +2980,7 @@ dependencies = [
  "bson",
  "dashmap",
  "deadqueue",
+ "decancer",
  "dotenv",
  "futures",
  "impl_ops",
@@ -3012,7 +3019,7 @@ dependencies = [
 
 [[package]]
 name = "revolt-result"
-version = "0.6.0"
+version = "0.6.1"
 dependencies = [
  "revolt_okapi",
  "revolt_rocket_okapi",

crates/bonfire/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-bonfire"
-version = "0.6.0"
+version = "0.6.1"
 license = "AGPL-3.0-or-later"
 edition = "2021"
 

crates/core/database/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-database"
-version = "0.6.0"
+version = "0.6.1"
 edition = "2021"
 license = "AGPL-3.0-or-later"
 authors = [ "Paul Makles <me@insrt.uk>" ]
@@ -22,10 +22,10 @@ default = [ "mongodb", "async-std-runtime" ]
 
 [dependencies]
 # Core
-revolt-result = { version = "0.6.0", path = "../result" }
+revolt-result = { version = "0.6.1", path = "../result" }
-revolt-models = { version = "0.6.0", path = "../models" }
+revolt-models = { version = "0.6.1", path = "../models" }
-revolt-presence = { version = "0.6.0", path = "../presence" }
+revolt-presence = { version = "0.6.1", path = "../presence" }
-revolt-permissions = { version = "0.6.0", path = "../permissions", features = [ "serde", "bson" ] }
+revolt-permissions = { version = "0.6.1", path = "../permissions", features = [ "serde", "bson" ] }
 
 # Utility
 log = "0.4"

crates/core/database/src/models/users/model.rs

@@ -16,7 +16,8 @@ auto_derived_partial!(
         /// Discriminator
         pub discriminator: String,
         /// Display name
-        pub display_name: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        pub display_name: Option<String>,
         #[serde(skip_serializing_if = "Option::is_none")]
         /// Avatar attachment
         pub avatar: Option<File>,
@@ -208,8 +209,10 @@ pub static DISCRIMINATOR_SEARCH_SPACE: Lazy<HashSet<String>> = Lazy::new(|| {
         .map(|v| format!("{:0>4}", v))
         .collect::<HashSet<String>>();
 
-    for discrim in [1111, 2222, 3333, 4444, 5555, 6666, 7777, 8888, 9999] {
+    for discrim in [
-        set.remove(&discrim.to_string());
+        123, 1234, 1111, 2222, 3333, 4444, 5555, 6666, 7777, 8888, 9999,
+    ] {
+        set.remove(&format!("{:0>4}", discrim));
     }
 
     set.into_iter().collect()

crates/core/models/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-models"
-version = "0.6.0"
+version = "0.6.1"
 edition = "2021"
 license = "AGPL-3.0-or-later"
 authors = [ "Paul Makles <me@insrt.uk>" ]
@@ -18,7 +18,7 @@ default = [ "serde", "partials" ]
 
 [dependencies]
 # Core
-revolt-permissions = { version = "0.6.0", path = "../permissions" }
+revolt-permissions = { version = "0.6.1", path = "../permissions" }
 
 # Serialisation
 revolt_optional_struct = { version = "0.2.0", optional = true }

crates/core/models/src/v0/users.rs

@@ -11,7 +11,8 @@ auto_derived!(
         /// Discriminator
         pub discriminator: String,
         /// Display name
-        pub display_name: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        pub display_name: Option<String>,
         #[serde(skip_serializing_if = "Option::is_none")]
         /// Avatar attachment
         pub avatar: Option<File>,

crates/core/permissions/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-permissions"
-version = "0.6.0"
+version = "0.6.1"
 edition = "2021"
 license = "AGPL-3.0-or-later"
 authors = [ "Paul Makles <me@insrt.uk>" ]

crates/core/presence/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-presence"
-version = "0.6.0"
+version = "0.6.1"
 edition = "2021"
 license = "AGPL-3.0-or-later"
 authors = [ "Paul Makles <me@insrt.uk>" ]

crates/core/result/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-result"
-version = "0.6.0"
+version = "0.6.1"
 edition = "2021"
 license = "AGPL-3.0-or-later"
 authors = [ "Paul Makles <me@insrt.uk>" ]

crates/delta/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-delta"
-version = "0.6.0"
+version = "0.6.1"
 license = "AGPL-3.0-or-later"
 authors = ["Paul Makles <paulmakles@gmail.com>"]
 edition = "2018"

crates/delta/src/routes/users/edit_user.rs

@@ -27,7 +27,6 @@ pub struct UserProfileData {
 #[derive(Validate, Serialize, Deserialize, JsonSchema)]
 pub struct DataEditUser {
     /// New display name
-    #[serde(rename = "displayName")]
     #[validate(length(min = 2, max = 32), regex = "RE_DISPLAY_NAME")]
     display_name: Option<String>,
     /// Attachment Id for avatar
@@ -123,6 +122,7 @@ pub async fn req(
     }
 
     let mut partial: PartialUser = PartialUser {
+        display_name: data.display_name,
         badges: data.badges,
         flags: data.flags,
         ..Default::default()

crates/quark/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-quark"
-version = "0.6.0"
+version = "0.6.1"
 edition = "2021"
 license = "AGPL-3.0-or-later"
 
@@ -64,6 +64,7 @@ nanoid = "0.4.0"
 linkify = "0.8.1"
 dotenv = "0.15.0"
 indexmap = "1.9.1"
+decancer = "1.6.2"
 impl_ops = "0.1.1"
 num_enum = "0.5.6"
 reqwest = "0.11.10"

crates/quark/src/impl/generic/users/user.rs

@@ -68,6 +68,7 @@ impl User {
                     x.background = None;
                 }
             }
+            FieldsUser::DisplayName => self.display_name = None,
         }
     }
 
@@ -176,6 +177,11 @@ impl User {
         // Copy the username for validation
         let username_lowercase = username.to_lowercase();
 
+        // Block homoglyphs
+        if decancer::cure(&username_lowercase).into_str() != username_lowercase {
+            return Err(Error::InvalidUsername);
+        }
+
         // Ensure the username itself isn't blocked
         const BLOCKED_USERNAMES: &[&str] = &["admin", "revolt"];
 
@@ -457,8 +463,10 @@ pub static DISCRIMINATOR_SEARCH_SPACE_QUARK: Lazy<HashSet<String>> = Lazy::new(|
         .map(|v| format!("{:0>4}", v))
         .collect::<HashSet<String>>();
 
-    for discrim in [1111, 2222, 3333, 4444, 5555, 6666, 7777, 8888, 9999] {
+    for discrim in [
-        set.remove(&discrim.to_string());
+        123, 1234, 1111, 2222, 3333, 4444, 5555, 6666, 7777, 8888, 9999,
+    ] {
+        set.remove(&format!("{:0>4}", discrim));
     }
 
     set.into_iter().collect()

crates/quark/src/impl/mongo/users/user.rs

@@ -337,6 +337,7 @@ impl IntoDocumentPath for FieldsUser {
             FieldsUser::ProfileContent => "profile.content",
             FieldsUser::StatusPresence => "status.presence",
             FieldsUser::StatusText => "status.text",
+            FieldsUser::DisplayName => "display_name",
         })
     }
 }

crates/quark/src/models/users/user.rs

@@ -131,7 +131,8 @@ pub struct User {
     /// Discriminator
     pub discriminator: String,
     /// Display name
-    pub display_name: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub display_name: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     /// Avatar attachment
     pub avatar: Option<File>,
@@ -176,6 +177,7 @@ pub enum FieldsUser {
     StatusPresence,
     ProfileContent,
     ProfileBackground,
+    DisplayName,
 }
 
 /// Enumeration providing a hint to the type of user we are handling

crates/quark/src/util/manipulation.rs

@@ -8,6 +8,6 @@ pub fn prefix_keys<T: Serialize>(t: &T, prefix: &str) -> HashMap<String, serde_j
     let v: HashMap<String, serde_json::Value> = serde_json::from_str(&v).unwrap();
     v.into_iter()
         .filter(|(_k, v)| !v.is_null())
-        .map(|(k, v)| (prefix.to_owned() + &k, v))
+        .map(|(k, v)| (format!("{}{}", prefix.to_owned(), k), v))
         .collect()
 }