1182909 - Prevent new accounts from CCing large numbers of users

Status: RESOLVED FIXED

(bugzilla.mozilla.org :: Extensions, defect)

Description

[Kris Maglione [:kmag]]

A disgruntled former user has been creating abusive bugs and CCing every account with a Mozilla email address.

It would be nice to be able to specifically target these bugs, but I can't think of a good reason for a new account to be able to CC over 1,000 users. Limiting them to adding, say, 5 CCs to a given bug should hopefully curb the problem.

Comment 1

[fdsc]

5 CCs + timeout for user.

Comment 2

[Paul Rouget [:paul]]

(When bugs are cloned, usually more than 5 people are cc'ed)

Comment 3

[Kris Maglione [:kmag]]

(In reply to Paul Rouget [:paul] from comment #2)
> (When bugs are cloned, usually more than 5 people are cc'ed)

Fair point, but it usually takes people at least a few months to learn about cloning bugs.

Comment 4

[:glob ✱]

blocking on 5 CCs is fine, but this limit should only apply to accounts created within the last 24 hours (ie. use a different metric for "new" than the "new to bugzilla" tag).

dropping priority because this is appears to be a single occurrence (across 3 bugs) and i've dealt with individual by preventing them from creating any new accounts.

Comment 5

[:glob ✱]

Attachment: 1182909_1.patch

- adds antispam_cc_limit_age (default:2) and antispam_cc_limit_count (default:5) parameters
- ignores cc requests from new accounts that exceed the limit

Comment 6

[Dylan Hardison [:dylan] (he/him)]

Comment on attachment 8632860 [details] [diff] [review]
1182909_1.patch

Review of attachment 8632860 [details] [diff] [review]:
-----------------------------------------------------------------

r- found a bug

::: extensions/AntiSpam/Extension.pm
@@ +143,5 @@
> +    my ($self, $params, $cc_field) = @_;
> +    return unless exists $params->{$cc_field};
> +
> +    my $user = Bugzilla->user;
> +    my $cc_count = scalar(@{ $params->{$cc_field} });

Can't use string ("[e-mail]") as an ARRAY ref while "strict refs" in use at ./extensions/AntiSpam/Extension.pm line 147.

perhaps $cc_count = ref $params->{$cc_field} ? 0 + @{ $params->{$cc_field} } : 1

Comment 7

[:glob ✱]

Attachment: 1182909_2.patch

Comment 8

[Dylan Hardison [:dylan] (he/him)]

Comment on attachment 8632918 [details] [diff] [review]
1182909_2.patch

r=dylan

Comment 9

[:glob ✱]

To ssh://[e-mail]/webtools/bmo/bugzilla.git
   43740a1..da4255a  master -> master

Comment 10

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

Can be this done also to needinfo and other places?
See e.g. in this bug #1160000 which was affected.

Comment 11

[:glob ✱]

(In reply to Virtual_ManPL [:Virtual] from comment #10)
> Can be this done also to needinfo and other places?
> See e.g. in this bug #1160000 which was affected.

yes -- last night i was putting out that particular fire.  i plan on extending this to flags and other multi-user fields today.