Security considerations for special characters in usernames?

Question

I would like to create some users on a Drupal site where the usernames are actually company names and some of those company names contain ampersands or other non-alphanumeric characters.

I have read this answer which describes how that might be achieved (by overriding the form validation for creating/editing a user).

My question is: Would there be some security risk in allowing special characters such as &/#?()+ in usernames, or did the Drupal developers make these characters illegal purely for aesthetic reasons?

Answer 1

I can think of three concerns when it comes to usernames and security: Cross Site Scripting (XSS), SQL Injection, and Homograph "attacks".

As long as you don't allow the < and > in usernames then you don't have to worry about XSS. If you want to allow one or both of those then you need to be more suspicious and do a thorough test of your site for XSS by entering a malicious username and seeing what happens.

SQL Injection should not be a problem. This has largely been solved in Drupal for a while and DBTNG in Drupal 7 makes it even less common. You could still test for it with some weird usernames that contain '; and other character combinations.

Homograph is then the worst thing. For a while (maybe still) you could register a username like Admin which looks a lot like Admin but in fact uses the MATHEMATICAL BOLD CAPITAL A from the list of confusables. The problem would arise from someone using a username that is a homographic match to a known "admin" on your site to register on the site and then using the contact or private message feature of the site (or even a public node/comment) to trick other users of the site into doing something stupid (e.g. posting a message "Our site is having login problems, please go to http://sitename.evil.example/password-reset and enter your credentials to have your login fixed."). By adding more characters to the allowed set of username characters you make a homograph social-engineering attack more likely/easier. I don't consider this to be a big problem and you should consider whether this is really a problem for your site before worrying about it.

The Real Name module is meant to give you this ability without the form alter. I don't think it's really any safer for homograph attacks, though.

Answer 2

Security? Not really, as all database communication is now wrapped in prepared statements. But they may break your URLs, as Drupal core is not really prepared to handle URL-unsafe usernames.

I suggest leave them be, and just add a field to a profile, call it "display name", and use it instead of username whenever you need a pretty name with URL-unsafe characters. It will be easier than changing default username handling.