jeirmeister/Cockatrice
1
0
Fork 0
mirror of https://github.com/Cockatrice/Cockatrice.git synced 2026-11-05 01:23:24 -08:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

[Server] Fix alt search review findings

Browse source 
- Seed the BFS with the stored user name so the searched account is not
  re-listed as its own alt at depth 1.
- Normalise emails to lower case for the membership and fan-out checks;
  SQL compares them case-insensitively.
- Widen the per-level row limit by the visited count so level 2+ cannot
  return only already-known accounts.
- Prepare dynamic IN-list queries locally instead of through the shared
  prepared-statement cache, whose keys are query texts.
- Count historic client-id fan-out from _sessions, not from the current
  _users ids.
- Order capped identifiers by relevance (current email/client id first,
  then most recent session IPs) instead of alphabetically.
This commit is contained in:
Lukas Brübach 2026-11-01 12:07:53 +01:00
parent 6b1bcc2caf
commit db751ca14c
1 changed files with 157 additions and 106 deletions
Download patch file Download diff file Expand all files Collapse all files

263
servatrice/src/servatrice_database_interface.cpp
View file

@ -2018,14 +2018,22 @@ struct AltCandidate
bool isActive = false; bool isActive = false;
}; };
QList<QString> cappedIdentifiers(QSet<QString> values) // Keeps the first-seen order: callers add the strongest evidence first so the
// cap below drops the least relevant identifiers rather than an arbitrary slice.
void appendIdentifier(QList<QString> &list, QSet<QString> &seen, const QString &value)
{ {
QList<QString> list = values.values(); if (!value.isEmpty() && !seen.contains(value)) {
std::sort(list.begin(), list.end()); seen.insert(value);
if (list.size() > MAX_USER_ALT_IDENTIFIERS) { list << value;
list.erase(list.begin() + MAX_USER_ALT_IDENTIFIERS, list.end());
} }
return list; }
QList<QString> cappedIdentifiers(const QList<QString> &values)
{
if (values.size() <= MAX_USER_ALT_IDENTIFIERS) {
return values;
}
return values.mid(0, MAX_USER_ALT_IDENTIFIERS);
} }
} // namespace } // namespace
@ -2087,46 +2095,59 @@ QList<ServerInfo_UserAlt> Servatrice_DatabaseInterface::getUserAlts(const QStrin
.isActive = seedQuery->value(7).toBool()}; .isActive = seedQuery->value(7).toBool()};
appendAlt(seed, QStringLiteral("self"), 0, 1); appendAlt(seed, QStringLiteral("self"), 0, 1);
QSet<QString> visited{userName}; // Identifier lookups are case-insensitive in SQL, so the seed must be keyed by
QList<QString> frontier{userName}; // its stored casing: otherwise the level-1 query re-lists it as an alt.
QSet<QString> visited{seed.name};
QList<QString> frontier{seed.name};
// Dynamic IN-lists bypass prepareQuery(): it caches by query text, so every
// distinct list size would leave a prepared statement in the long-lived cache
// and can exhaust MySQL's max_prepared_stmt_count.
const QString dbPrefix = server->getDbPrefix();
auto prepareDynamicQuery = [&dbPrefix](QSqlQuery &query, const QString &queryText) {
QString text = queryText;
text.replace(QStringLiteral("{prefix}"), dbPrefix);
query.prepare(text);
};
for (int level = 1; level <= depth && !frontier.isEmpty(); ++level) { for (int level = 1; level <= depth && !frontier.isEmpty(); ++level) {
const QString frontierClause = altInClause(QStringLiteral(":alt_name"), frontier); const QString frontierClause = altInClause(QStringLiteral(":alt_name"), frontier);
// Current identifiers of the frontier: registration email + client id. // Current identifiers of the frontier: registration email + client id.
QSet<QString> emails; // Kept strongest-first so cappedIdentifiers() drops the least useful ones.
QSet<QString> clientIds; QList<QString> emails;
QSet<QString> ips; QList<QString> clientIds;
QSqlQuery *frontierQuery = QList<QString> ips;
prepareQuery(QStringLiteral("SELECT email, clientid FROM {prefix}_users WHERE name IN ") + frontierClause); QSet<QString> emailKeys;
altBindValues(frontierQuery, QStringLiteral(":alt_name"), frontier); QSet<QString> clientIdKeys;
if (execSqlQuery(frontierQuery)) { QSet<QString> ipKeys;
while (frontierQuery->next()) {
const QString email = frontierQuery->value(0).toString(); QSqlQuery frontierQuery(sqlDatabase);
const QString clientId = frontierQuery->value(1).toString(); prepareDynamicQuery(frontierQuery, QStringLiteral("SELECT email, clientid FROM {prefix}_users WHERE name IN ") +
if (!email.isEmpty()) { frontierClause);
emails << email; altBindValues(&frontierQuery, QStringLiteral(":alt_name"), frontier);
} if (execSqlQuery(&frontierQuery)) {
if (!clientId.isEmpty()) { while (frontierQuery.next()) {
clientIds << clientId; // Email comparison is case-insensitive in SQL, so normalise the
} // keys too or the membership tests below miss real matches.
appendIdentifier(emails, emailKeys, frontierQuery.value(0).toString().toLower());
appendIdentifier(clientIds, clientIdKeys, frontierQuery.value(1).toString());
} }
} }
// Recent session identifiers: IPs plus historic client ids. // Recent session identifiers: IPs plus historic client ids, most recent
QSqlQuery *sessionQuery = prepareQuery( // first so a capped list keeps what the account actually used lately.
QStringLiteral("SELECT DISTINCT ip_address, clientid FROM {prefix}_sessions WHERE user_name IN ") + QSqlQuery sessionQuery(sqlDatabase);
frontierClause + QStringLiteral(" AND start_time >= DATE_SUB(NOW(), INTERVAL 6 MONTH)")); prepareDynamicQuery(sessionQuery, QStringLiteral("SELECT ip_address, clientid, MAX(start_time) AS last_seen "
altBindValues(sessionQuery, QStringLiteral(":alt_name"), frontier); "FROM {prefix}_sessions WHERE user_name IN ") +
if (execSqlQuery(sessionQuery)) { frontierClause +
while (sessionQuery->next()) { QStringLiteral(" AND start_time >= DATE_SUB(NOW(), INTERVAL 6 MONTH) "
const QString ip = sessionQuery->value(0).toString(); "GROUP BY ip_address, clientid ORDER BY last_seen DESC"));
const QString clientId = sessionQuery->value(1).toString(); altBindValues(&sessionQuery, QStringLiteral(":alt_name"), frontier);
if (!ip.isEmpty()) { if (execSqlQuery(&sessionQuery)) {
ips << ip; while (sessionQuery.next()) {
} appendIdentifier(ips, ipKeys, sessionQuery.value(0).toString());
if (!clientId.isEmpty()) { appendIdentifier(clientIds, clientIdKeys, sessionQuery.value(1).toString());
clientIds << clientId;
}
} }
} }
@ -2146,9 +2167,9 @@ QList<ServerInfo_UserAlt> Servatrice_DatabaseInterface::getUserAlts(const QStrin
"LEFT JOIN {prefix}_user_analytics a ON a.id = u.id " "LEFT JOIN {prefix}_user_analytics a ON a.id = u.id "
"WHERE "); "WHERE ");
QStringList conditions; QStringList conditions;
QList<QString> emailList = cappedIdentifiers(emails); const QList<QString> emailList = cappedIdentifiers(emails);
QList<QString> clientIdList = cappedIdentifiers(clientIds); const QList<QString> clientIdList = cappedIdentifiers(clientIds);
QList<QString> ipList = cappedIdentifiers(ips); const QList<QString> ipList = cappedIdentifiers(ips);
if (!emailList.isEmpty()) { if (!emailList.isEmpty()) {
conditions << QStringLiteral("u.email IN ") + altInClause(QStringLiteral(":alt_email"), emailList); conditions << QStringLiteral("u.email IN ") + altInClause(QStringLiteral(":alt_email"), emailList);
} }
@ -2168,33 +2189,38 @@ QList<ServerInfo_UserAlt> Servatrice_DatabaseInterface::getUserAlts(const QStrin
QStringLiteral(" AND s.start_time >= DATE_SUB(NOW(), INTERVAL 6 MONTH))"); QStringLiteral(" AND s.start_time >= DATE_SUB(NOW(), INTERVAL 6 MONTH))");
} }
candidateString += conditions.join(QStringLiteral(" OR ")); candidateString += conditions.join(QStringLiteral(" OR "));
candidateString += QStringLiteral(" ORDER BY u.name LIMIT ") + QString::number(MAX_USER_ALTS_PER_LEVEL); // Already-visited accounts match their own identifiers at every level and
// are dropped below, so widen the row limit by that count: otherwise a
// second level can return only visited rows and no new candidates.
candidateString +=
QStringLiteral(" ORDER BY u.name LIMIT ") + QString::number(MAX_USER_ALTS_PER_LEVEL + visited.size());
QSqlQuery *candidateQuery = prepareQuery(candidateString); QSqlQuery candidateQuery(sqlDatabase);
altBindValues(candidateQuery, QStringLiteral(":alt_email"), emailList); prepareDynamicQuery(candidateQuery, candidateString);
altBindValues(candidateQuery, QStringLiteral(":alt_cid"), clientIdList); altBindValues(&candidateQuery, QStringLiteral(":alt_email"), emailList);
altBindValues(candidateQuery, QStringLiteral(":alt_ip"), ipList); altBindValues(&candidateQuery, QStringLiteral(":alt_cid"), clientIdList);
altBindValues(candidateQuery, QStringLiteral(":alt_hcid"), clientIdList); altBindValues(&candidateQuery, QStringLiteral(":alt_ip"), ipList);
if (!execSqlQuery(candidateQuery)) { altBindValues(&candidateQuery, QStringLiteral(":alt_hcid"), clientIdList);
if (!execSqlQuery(&candidateQuery)) {
qCWarning(DatabaseInterfaceLog) << "Failed to collect user alt information: SQL Error"; qCWarning(DatabaseInterfaceLog) << "Failed to collect user alt information: SQL Error";
return results; return results;
} }
QList<AltCandidate> candidates; QList<AltCandidate> candidates;
while (candidateQuery->next()) { while (candidateQuery.next()) {
AltCandidate candidate; AltCandidate candidate;
candidate.name = candidateQuery->value(0).toString(); candidate.name = candidateQuery.value(0).toString();
if (visited.contains(candidate.name)) { if (visited.contains(candidate.name)) {
continue; continue;
} }
candidate.email = candidateQuery->value(1).toString(); candidate.email = candidateQuery.value(1).toString();
candidate.clientId = candidateQuery->value(2).toString(); candidate.clientId = candidateQuery.value(2).toString();
candidate.registrationTime = candidateQuery->value(3).toLongLong(); candidate.registrationTime = candidateQuery.value(3).toLongLong();
candidate.hasLastLogin = !candidateQuery->value(4).isNull(); candidate.hasLastLogin = !candidateQuery.value(4).isNull();
candidate.lastLogin = candidateQuery->value(4).toLongLong(); candidate.lastLogin = candidateQuery.value(4).toLongLong();
candidate.warnCount = candidateQuery->value(5).toInt(); candidate.warnCount = candidateQuery.value(5).toInt();
candidate.banCount = candidateQuery->value(6).toInt(); candidate.banCount = candidateQuery.value(6).toInt();
candidate.isActive = candidateQuery->value(7).toBool(); candidate.isActive = candidateQuery.value(7).toBool();
candidates << candidate; candidates << candidate;
} }
@ -2204,13 +2230,13 @@ QList<ServerInfo_UserAlt> Servatrice_DatabaseInterface::getUserAlts(const QStrin
QMap<QString, QString> candidateHistoricClientId; QMap<QString, QString> candidateHistoricClientId;
QList<QString> unexplained; QList<QString> unexplained;
for (const AltCandidate &candidate : candidates) { for (const AltCandidate &candidate : candidates) {
const bool emailMatch = !candidate.email.isEmpty() && emails.contains(candidate.email); const bool emailMatch = !candidate.email.isEmpty() && emailKeys.contains(candidate.email.toLower());
const bool clientIdMatch = !candidate.clientId.isEmpty() && clientIds.contains(candidate.clientId); const bool clientIdMatch = !candidate.clientId.isEmpty() && clientIdKeys.contains(candidate.clientId);
if (!emailMatch && !clientIdMatch) { if (!emailMatch && !clientIdMatch) {
unexplained << candidate.name; unexplained << candidate.name;
} }
} }
if (!unexplained.isEmpty() && (!ips.isEmpty() || !clientIds.isEmpty())) { if (!unexplained.isEmpty() && (!ipKeys.isEmpty() || !clientIdKeys.isEmpty())) {
QString evidenceString = QString evidenceString =
QStringLiteral("SELECT DISTINCT user_name, ip_address, clientid FROM {prefix}_sessions WHERE " QStringLiteral("SELECT DISTINCT user_name, ip_address, clientid FROM {prefix}_sessions WHERE "
"user_name IN ") + "user_name IN ") +
@ -2227,19 +2253,20 @@ QList<ServerInfo_UserAlt> Servatrice_DatabaseInterface::getUserAlts(const QStrin
evidenceString += evidenceConditions.join(QStringLiteral(" OR ")); evidenceString += evidenceConditions.join(QStringLiteral(" OR "));
evidenceString += QStringLiteral(") AND start_time >= DATE_SUB(NOW(), INTERVAL 6 MONTH)"); evidenceString += QStringLiteral(") AND start_time >= DATE_SUB(NOW(), INTERVAL 6 MONTH)");
QSqlQuery *evidenceQuery = prepareQuery(evidenceString); QSqlQuery evidenceQuery(sqlDatabase);
altBindValues(evidenceQuery, QStringLiteral(":alt_ev"), unexplained); prepareDynamicQuery(evidenceQuery, evidenceString);
altBindValues(evidenceQuery, QStringLiteral(":alt_eip"), ipList); altBindValues(&evidenceQuery, QStringLiteral(":alt_ev"), unexplained);
altBindValues(evidenceQuery, QStringLiteral(":alt_ecid"), clientIdList); altBindValues(&evidenceQuery, QStringLiteral(":alt_eip"), ipList);
if (execSqlQuery(evidenceQuery)) { altBindValues(&evidenceQuery, QStringLiteral(":alt_ecid"), clientIdList);
while (evidenceQuery->next()) { if (execSqlQuery(&evidenceQuery)) {
const QString name = evidenceQuery->value(0).toString(); while (evidenceQuery.next()) {
const QString ip = evidenceQuery->value(1).toString(); const QString name = evidenceQuery.value(0).toString();
const QString clientId = evidenceQuery->value(2).toString(); const QString ip = evidenceQuery.value(1).toString();
if (!ip.isEmpty() && ips.contains(ip) && !candidateIp.contains(name)) { const QString clientId = evidenceQuery.value(2).toString();
if (!ip.isEmpty() && ipKeys.contains(ip) && !candidateIp.contains(name)) {
candidateIp.insert(name, ip); candidateIp.insert(name, ip);
} }
if (!clientId.isEmpty() && clientIds.contains(clientId) && if (!clientId.isEmpty() && clientIdKeys.contains(clientId) &&
!candidateHistoricClientId.contains(name)) { !candidateHistoricClientId.contains(name)) {
candidateHistoricClientId.insert(name, clientId); candidateHistoricClientId.insert(name, clientId);
} }
@ -2250,58 +2277,82 @@ QList<ServerInfo_UserAlt> Servatrice_DatabaseInterface::getUserAlts(const QStrin
// Fan-out counts so moderators can spot VPN/shared-network false positives. // Fan-out counts so moderators can spot VPN/shared-network false positives.
QMap<QString, int> emailCounts; QMap<QString, int> emailCounts;
QMap<QString, int> clientIdCounts; QMap<QString, int> clientIdCounts;
QMap<QString, int> historicClientIdCounts;
QMap<QString, int> ipCounts; QMap<QString, int> ipCounts;
QSet<QString> neededEmails; QSet<QString> neededEmails;
QSet<QString> neededClientIds; QSet<QString> neededClientIds;
QSet<QString> neededHistoricClientIds;
QSet<QString> neededIps; QSet<QString> neededIps;
for (const AltCandidate &candidate : candidates) { for (const AltCandidate &candidate : candidates) {
if (!candidate.email.isEmpty() && emails.contains(candidate.email)) { if (!candidate.email.isEmpty() && emailKeys.contains(candidate.email.toLower())) {
neededEmails << candidate.email; neededEmails << candidate.email.toLower();
} else if (!candidate.clientId.isEmpty() && clientIds.contains(candidate.clientId)) { } else if (!candidate.clientId.isEmpty() && clientIdKeys.contains(candidate.clientId)) {
neededClientIds << candidate.clientId; neededClientIds << candidate.clientId;
} else if (candidateHistoricClientId.contains(candidate.name)) { } else if (candidateHistoricClientId.contains(candidate.name)) {
neededClientIds << candidateHistoricClientId.value(candidate.name); neededHistoricClientIds << candidateHistoricClientId.value(candidate.name);
} else if (candidateIp.contains(candidate.name)) { } else if (candidateIp.contains(candidate.name)) {
neededIps << candidateIp.value(candidate.name); neededIps << candidateIp.value(candidate.name);
} }
} }
if (!neededEmails.isEmpty()) { if (!neededEmails.isEmpty()) {
const QList<QString> neededEmailList = neededEmails.values(); const QList<QString> neededEmailList = neededEmails.values();
QSqlQuery *countQuery = prepareQuery(QStringLiteral("SELECT email, COUNT(*) FROM {prefix}_users WHERE " QSqlQuery countQuery(sqlDatabase);
"email IN ") + prepareDynamicQuery(countQuery, QStringLiteral("SELECT email, COUNT(*) FROM {prefix}_users WHERE "
altInClause(QStringLiteral(":alt_ce"), neededEmailList) + "email IN ") +
QStringLiteral(" GROUP BY email")); altInClause(QStringLiteral(":alt_ce"), neededEmailList) +
altBindValues(countQuery, QStringLiteral(":alt_ce"), neededEmailList); QStringLiteral(" GROUP BY email"));
if (execSqlQuery(countQuery)) { altBindValues(&countQuery, QStringLiteral(":alt_ce"), neededEmailList);
while (countQuery->next()) { if (execSqlQuery(&countQuery)) {
emailCounts.insert(countQuery->value(0).toString(), countQuery->value(1).toInt()); while (countQuery.next()) {
emailCounts.insert(countQuery.value(0).toString().toLower(), countQuery.value(1).toInt());
} }
} }
} }
if (!neededClientIds.isEmpty()) { if (!neededClientIds.isEmpty()) {
const QList<QString> neededClientIdList = neededClientIds.values(); const QList<QString> neededClientIdList = neededClientIds.values();
QSqlQuery *countQuery = prepareQuery(QStringLiteral("SELECT clientid, COUNT(*) FROM {prefix}_users WHERE " QSqlQuery countQuery(sqlDatabase);
"clientid IN ") + prepareDynamicQuery(countQuery, QStringLiteral("SELECT clientid, COUNT(*) FROM {prefix}_users WHERE "
altInClause(QStringLiteral(":alt_cc"), neededClientIdList) + "clientid IN ") +
QStringLiteral(" GROUP BY clientid")); altInClause(QStringLiteral(":alt_cc"), neededClientIdList) +
altBindValues(countQuery, QStringLiteral(":alt_cc"), neededClientIdList); QStringLiteral(" GROUP BY clientid"));
if (execSqlQuery(countQuery)) { altBindValues(&countQuery, QStringLiteral(":alt_cc"), neededClientIdList);
while (countQuery->next()) { if (execSqlQuery(&countQuery)) {
clientIdCounts.insert(countQuery->value(0).toString(), countQuery->value(1).toInt()); while (countQuery.next()) {
clientIdCounts.insert(countQuery.value(0).toString(), countQuery.value(1).toInt());
}
}
}
// Historic client ids are matched through sessions, so their fan-out must
// come from _sessions too: _users only knows each account's current id.
if (!neededHistoricClientIds.isEmpty()) {
const QList<QString> neededHistoricClientIdList = neededHistoricClientIds.values();
QSqlQuery countQuery(sqlDatabase);
prepareDynamicQuery(countQuery,
QStringLiteral("SELECT clientid, COUNT(DISTINCT user_name) FROM {prefix}_sessions "
"WHERE clientid IN ") +
altInClause(QStringLiteral(":alt_hcc"), neededHistoricClientIdList) +
QStringLiteral(" AND start_time >= DATE_SUB(NOW(), INTERVAL 6 MONTH) "
"GROUP BY clientid"));
altBindValues(&countQuery, QStringLiteral(":alt_hcc"), neededHistoricClientIdList);
if (execSqlQuery(&countQuery)) {
while (countQuery.next()) {
historicClientIdCounts.insert(countQuery.value(0).toString(), countQuery.value(1).toInt());
} }
} }
} }
if (!neededIps.isEmpty()) { if (!neededIps.isEmpty()) {
const QList<QString> neededIpList = neededIps.values(); const QList<QString> neededIpList = neededIps.values();
QSqlQuery *countQuery = prepareQuery( QSqlQuery countQuery(sqlDatabase);
QStringLiteral("SELECT ip_address, COUNT(DISTINCT user_name) FROM {prefix}_sessions WHERE " prepareDynamicQuery(countQuery,
"ip_address IN ") + QStringLiteral("SELECT ip_address, COUNT(DISTINCT user_name) FROM {prefix}_sessions "
altInClause(QStringLiteral(":alt_ci"), neededIpList) + "WHERE ip_address IN ") +
QStringLiteral(" AND start_time >= DATE_SUB(NOW(), INTERVAL 6 MONTH) GROUP BY ip_address")); altInClause(QStringLiteral(":alt_ci"), neededIpList) +
altBindValues(countQuery, QStringLiteral(":alt_ci"), neededIpList); QStringLiteral(" AND start_time >= DATE_SUB(NOW(), INTERVAL 6 MONTH) "
if (execSqlQuery(countQuery)) { "GROUP BY ip_address"));
while (countQuery->next()) { altBindValues(&countQuery, QStringLiteral(":alt_ci"), neededIpList);
ipCounts.insert(countQuery->value(0).toString(), countQuery->value(1).toInt()); if (execSqlQuery(&countQuery)) {
while (countQuery.next()) {
ipCounts.insert(countQuery.value(0).toString(), countQuery.value(1).toInt());
} }
} }
} }
@ -2310,16 +2361,16 @@ QList<ServerInfo_UserAlt> Servatrice_DatabaseInterface::getUserAlts(const QStrin
for (const AltCandidate &candidate : candidates) { for (const AltCandidate &candidate : candidates) {
QString matchReason; QString matchReason;
int sharedCount = 1; int sharedCount = 1;
if (!candidate.email.isEmpty() && emails.contains(candidate.email)) { if (!candidate.email.isEmpty() && emailKeys.contains(candidate.email.toLower())) {
matchReason = QStringLiteral("email"); matchReason = QStringLiteral("email");
sharedCount = qMax(1, emailCounts.value(candidate.email, 1)); sharedCount = qMax(1, emailCounts.value(candidate.email.toLower(), 1));
} else if (!candidate.clientId.isEmpty() && clientIds.contains(candidate.clientId)) { } else if (!candidate.clientId.isEmpty() && clientIdKeys.contains(candidate.clientId)) {
matchReason = QStringLiteral("clientid:") + candidate.clientId; matchReason = QStringLiteral("clientid:") + candidate.clientId;
sharedCount = qMax(1, clientIdCounts.value(candidate.clientId, 1)); sharedCount = qMax(1, clientIdCounts.value(candidate.clientId, 1));
} else if (candidateHistoricClientId.contains(candidate.name)) { } else if (candidateHistoricClientId.contains(candidate.name)) {
const QString historicId = candidateHistoricClientId.value(candidate.name); const QString historicId = candidateHistoricClientId.value(candidate.name);
matchReason = QStringLiteral("clientid:") + historicId; matchReason = QStringLiteral("clientid:") + historicId;
sharedCount = qMax(1, clientIdCounts.value(historicId, 1)); sharedCount = qMax(1, historicClientIdCounts.value(historicId, 1));
} else if (candidateIp.contains(candidate.name)) { } else if (candidateIp.contains(candidate.name)) {
const QString ip = candidateIp.value(candidate.name); const QString ip = candidateIp.value(candidate.name);
matchReason = QStringLiteral("ip:") + ip; matchReason = QStringLiteral("ip:") + ip;