chore: add additional sanitisation

Cargo.lock

@@ -806,6 +806,12 @@ dependencies = [
  "uuid",
 ]
 
+[[package]]
+name = "decancer"
+version = "1.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "808127a7de612079ec37bfc1abc48ed77a6015a971a8bd7d4178d79147cbc839"
+
 [[package]]
 name = "derivative"
 version = "2.2.0"
@@ -2974,6 +2980,7 @@ dependencies = [
  "bson",
  "dashmap",
  "deadqueue",
+ "decancer",
  "dotenv",
  "futures",
  "impl_ops",

crates/quark/Cargo.toml

@@ -64,6 +64,7 @@ nanoid = "0.4.0"
 linkify = "0.8.1"
 dotenv = "0.15.0"
 indexmap = "1.9.1"
+decancer = "1.6.2"
 impl_ops = "0.1.1"
 num_enum = "0.5.6"
 reqwest = "0.11.10"

crates/quark/src/impl/generic/users/user.rs

@@ -177,6 +177,11 @@ impl User {
         // Copy the username for validation
         let username_lowercase = username.to_lowercase();
 
+        // Block homoglyphs
+        if decancer::cure(&username_lowercase).into_str() != username_lowercase {
+            return Err(Error::InvalidUsername);
+        }
+
         // Ensure the username itself isn't blocked
         const BLOCKED_USERNAMES: &[&str] = &["admin", "revolt"];
 

crates/quark/src/util/manipulation.rs

@@ -8,6 +8,6 @@ pub fn prefix_keys<T: Serialize>(t: &T, prefix: &str) -> HashMap<String, serde_j
     let v: HashMap<String, serde_json::Value> = serde_json::from_str(&v).unwrap();
     v.into_iter()
         .filter(|(_k, v)| !v.is_null())
-        .map(|(k, v)| (prefix.to_owned() + &k, v))
+        .map(|(k, v)| (format!("{}{}", prefix.to_owned(), k), v))
         .collect()
 }