View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0006661 | unreal | ircd | public | 2026-11-12 21:26 | 2026-11-12 21:26 |
| Reporter | mattf | Assigned To | |||
| Priority | normal | Severity | feature | Reproducibility | always |
| Status | new | Resolution | open | ||
| Product Version | 6.2.7.1 | ||||
| Summary | 0006661: Spamfilter and text filters bypassed by invisible Unicode padding (feature request) | ||||
| Description | This was found through an agentic-driven scan of the source and is part of a batch of non-critical issues I found worth reporting. StripControlCodes() in src/misc.c removes the mIRC formatting codes and the zero-width space U+200B before the text is matched. It does not remove the other invisible or zero-width format characters, so a user can insert them between the letters of a banned phrase: clients render the text normally, but the spamfilter, textban, antirandom and antimixedutf8 matchers see the padded version and do not match. Characters that currently survive the strip include U+00AD (soft hyphen), U+200C through U+200F, U+2060 through U+2064, U+FEFF, U+180E, U+202F and U+2800. Similar issues: - https://bugs.unrealircd.org/view.php?id=6461 | ||||
| Steps To Reproduce | 1. An admin adds a spamfilter that blocks a phrase, for example BUYSPAM. 2. A user sends that phrase with U+00AD inserted between each letter (B, U+00AD, U, U+00AD, Y, ...). 3. The message is delivered and the filter does not match. Clients render it as "BUYSPAM". | ||||
| Additional Information | This is really more a feature request than a bug. UnrealIRCd already strips U+200B in StripControlCodes() for exactly this reason, and there is already a spamfilter input-conversion knob (input-conversion none;) that controls how the match text is normalized, so the machinery for this is already in place. The gap is just that the strip only covers U+200B and not the rest of the invisible or zero-width format characters. Handling the whole Unicode format category (Cf) as a class, instead of one code point at a time, would close the padding trick in one small change rather than chasing characters forever. It would be nice to have and the fix should not be large, so I think it is worth considering. Let me know if this is desired and I could PR it myself. | ||||
| 3rd party modules | |||||
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2026-11-12 21:26 | mattf | New Issue |
