Monitor new packages that might be typosquats #5001
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
If projects exist with a similar name as the project being created, add a Squat entry to the DB linking the two projects.
Display a list of squats in order that have not been reviewed, and make them "reviewable"/dismissable
On the project detail page, show a list of potential squatters and squattees for a given project.
|
🎉 |
ewdurbin
added a commit
that referenced
this pull request
Nov 10, 2018
* Migrate to UUID Primary Key for Project and Release models * fixup factories for Project and Release, sync Role model to migration * make reformat * fix at least one test * Fix fallout of Role.package_name removal * Remove Denormalized name and version fields from all models (#4974) * Update for #5001 * Ensure model state matches db state * Switch to using FKs to User.id isntead of User.username * Fix test * Fix linting * Add Release.uploader as a real FK (#5015) * Rename a number of tables to better fit in current scheme (#5016)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds the ability to check for and record potential typo-squats when a new project is being created. It uses the Levenshtein distance between the normalized project names to determine if a new project is potentially a typosquat. The results go into a queue of unreviewed reports is "reviewable" by PyPI admins.
This PR also adds the ability to list potential squatters/squattees in the project detail page of the admin UI, for projects that have already been created.
Towards #2268, but I'd like to experiment with this a bit before we call that issue resolved.