Protect community from confusable homoglyphs

liberapay/models/community.py

@@ -3,6 +3,7 @@
 
 from postgres.orm import Model
 from psycopg2 import IntegrityError
+from confusable_homoglyphs import confusables
 
 from liberapay.exceptions import CommunityAlreadyExists, InvalidCommunityName
 
@@ -38,8 +39,17 @@ def create(cls, name, creator_id, lang='mul'):
         name = unicodedata.normalize('NFKC', name)
         if name_re.match(name) is None:
             raise InvalidCommunityName(name)
+
         try:
             with cls.db.get_cursor() as cursor:
+                all_names = cursor.all("""
+                    SELECT name
+                    FROM communities
+                    """)
+                for existing_name in all_names:
+                    if cls._unconfusable(name) == cls._unconfusable(existing_name):
+                        raise CommunityAlreadyExists
+
                 p_id = cursor.one("""
                     INSERT INTO participants
                                 (kind, status, join_time)
@@ -91,3 +101,14 @@ def check_membership_status(self, participant):
     @property
     def nsubscribers(self):
         return self.participant.nsubscribers
+
+    @staticmethod
+    def _unconfusable(name):
+        unconfusable_name = ''
+        for c in name:
+            confusable = confusables.is_confusable(c, preferred_aliases=['COMMON', 'LATIN'])
+            if confusable:
+                # if the character is confusable we replace it with the first prefered alias
+                c = confusable[0]['homoglyphs'][0]['c']
+            unconfusable_name += c
+        return unconfusable_name

requirements_base.txt

@@ -243,3 +243,6 @@ cryptography==2.4.2 \
     asn1crypto==0.24.0 \
         --hash=sha256:2f1adbb7546ed199e3c90ef23ec95c5cf3585bac7d11fb7eb562a3fe89c64e87 \
         --hash=sha256:9d5c20441baf0cb60a4ac34cc447c6c189024b6b4c6cd7877034f4965c464e49
+confusable_homoglyphs==3.2.0 \
+    --hash=sha256:3b4a0d9fa510669498820c91a0bfc0c327568cecec90648cf3819d4a6fc6a751 \
+    --hash=sha256:e3ce611028d882b74a5faa69e3cbb5bd4dcd9f69936da6e73d33eda42c917944

tests/py/test_communities.py

@@ -1,6 +1,9 @@
 import json
 
-from liberapay.exceptions import AuthRequired
+from liberapay.exceptions import (
+    AuthRequired,
+    CommunityAlreadyExists,
+)
 from liberapay.models.community import Community
 from liberapay.testing import Harness
 
@@ -101,6 +104,30 @@ def test_join_and_leave(self):
         communities = self.bob.get_communities()
         assert len(communities) == 0
 
+    def test_create_community_already_taken(self):
+        with self.assertRaises(CommunityAlreadyExists):
+            Community.create('test', self.alice.id)
+
+    def test_create_community_already_taken_is_case_insensitive(self):
+        with self.assertRaises(CommunityAlreadyExists):
+            Community.create('TeSt', self.alice.id)
+
+    def test_unconfusable(self):
+        self.assertEqual('user2', Community._unconfusable('user2'))
+        self.assertEqual('alice', Community._unconfusable('alice'))
+        latin_string = 'AlaskaJazz'
+        mixed_string = 'ΑlaskaJazz'
+        self.assertNotEqual(latin_string, mixed_string)
+        self.assertEqual(latin_string, Community._unconfusable(mixed_string))
+
+    def test_create_community_already_taken_with_confusable_homoglyphs(self):
+        latin_string = 'AlaskaJazz'
+        mixed_string = 'ΑlaskaJazz'
+
+        Community.create(latin_string, self.bob.id)
+        with self.assertRaises(CommunityAlreadyExists):
+            Community.create(mixed_string, self.alice.id)
+
 
 class TestCommunityEdit(Harness):