From c8c1ddfb41b3a3304f46a33e8ed0e4636709c767 Mon Sep 17 00:00:00 2001
From: Shivaram Lingamneni <slingamn@cs.stanford.edu>
Date: Mon, 7 Dec 2020 13:35:58 -0500
Subject: [PATCH] fix #1439

Validate imported databases for confusable nicks
---
 irc/import.go | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/irc/import.go b/irc/import.go
index c70ec738..92e0682e 100644
--- a/irc/import.go
+++ b/irc/import.go
@@ -80,13 +80,24 @@ func doImportDBGeneric(config *Config, dbImport databaseImport, credsType Creden
 	tx.Set(keyCloakSecret, utils.GenerateSecretKey(), nil)
 
 	cfUsernames := make(utils.StringSet)
+	skeletonToUsername := make(map[string]string)
+	warnSkeletons := false
 
 	for username, userInfo := range dbImport.Users {
 		cfUsername, err := CasefoldName(username)
-		if err != nil {
-			log.Printf("invalid username %s: %v", username, err)
+		skeleton, skErr := Skeleton(username)
+		if err != nil || skErr != nil {
+			log.Printf("invalid username %s: %v\n", username, err)
 			continue
 		}
+
+		if existingSkelUser, ok := skeletonToUsername[skeleton]; ok {
+			log.Printf("Users %s and %s have confusable nicknames; this may render one or both accounts unusable\n", username, existingSkelUser)
+			warnSkeletons = true
+		} else {
+			skeletonToUsername[skeleton] = username
+		}
+
 		var certfps []string
 		for _, certfp := range userInfo.Certfps {
 			normalizedCertfp, err := utils.NormalizeCertfp(certfp)
@@ -103,7 +114,7 @@ func doImportDBGeneric(config *Config, dbImport databaseImport, credsType Creden
 		}
 		marshaledCredentials, err := json.Marshal(&credentials)
 		if err != nil {
-			log.Printf("invalid credentials for %s: %v", username, err)
+			log.Printf("invalid credentials for %s: %v\n", username, err)
 			continue
 		}
 		tx.Set(fmt.Sprintf(keyAccountExists, cfUsername), "1", nil)
@@ -178,6 +189,11 @@ func doImportDBGeneric(config *Config, dbImport databaseImport, credsType Creden
 		}
 	}
 
+	if warnSkeletons {
+		log.Printf("NOTE: you may be able to avoid confusability issues by changing the server casemapping setting to `ascii`\n")
+		log.Printf("However, this will prevent the use of non-ASCII Unicode characters in nicknames\n")
+	}
+
 	return nil
 }