Last modified: 2012-11-28 13:55:09 UTC
The latest software upgrade at Wikipedia and other Wikimedia projects reintroduces an old problem which allows registration of accounts containing non-printing characters such as ­. This can allow vandals to "pretend" to be someone else. For example, a vandal can regiser a username like Grunt%C2%AD (not actually using %C2%AD but by placing the non-printing character in the field...). I registered an account like this by creating a blank HTML with only the content &­ and then Ctrl+A, Ctrl+C'ing it.
imho the allowed stuff in usernames should be based on a whitelist. Using a blacklist means that you will always risk missing stuff that vandals would find usefull.
See also Bug 2290: user impersonation using homographs for a wider perspective...
see also bug 1524: usernames should use unicode whitelist
I tried to login within a "#$$%%%%" which throws the login error, "You have not specified a valid user name.". I also tried to do Ctrl^C, Ctrl^V, and other fields that I could think of. The form does allow you to enter illegal characters. So this issue is resolved for now.
Hi, I am sorry about the last sentence in the last post. I meant to say I tested and tried to reproduce the error but with no success.
(In reply to comment #4) > I tried to login within a "#$$%%%%" These are visible, printable characters. Comment 0 mentions "non-printing characters". See http://en.wikipedia.org/wiki/Non-printing_character I tried on test2.wikipedia.org (version 1.21wmf5) to create an account as Maly­acko (save as HTML file, open it in browser, copy from the browser display, as described in comment 0). RESULT: Login error The name "Malyacko" is not allowed to prevent confusing or spoofed usernames: Contains unassigned character U+00AD. Please choose another name. So I consider this FIXED as there is a check in place (though I don't know where a blacklist or whitelist is located though, and which exact characters are covered by it).
