From ca30fdd95cc6628dd91395c6b93d4f83b894377b Mon Sep 17 00:00:00 2001
From: Christopher Hoskin <4855578+mans0954@users.noreply.github.com>
Date: Tue, 12 Aug 2025 21:07:31 +0100
Subject: [PATCH] Merge pull request #27860 from overleaf/lg-spam-safe

Add spam check for incident

GitOrigin-RevId: 752180f7507e32219cc5faaef5d48fdc0003e889
---
 services/web/app/src/Features/Email/SpamSafe.js   | 9 +++++++++
 services/web/test/unit/src/Email/SpamSafeTests.js | 6 ++++++
 2 files changed, 15 insertions(+)

diff --git a/services/web/app/src/Features/Email/SpamSafe.js b/services/web/app/src/Features/Email/SpamSafe.js
index 1198099340..0518d9cf1f 100644
--- a/services/web/app/src/Features/Email/SpamSafe.js
+++ b/services/web/app/src/Features/Email/SpamSafe.js
@@ -11,6 +11,11 @@ const XRegExp = require('xregexp')
 const HAN_REGEX = XRegExp('\\p{Han}')
 const SAFE_REGEX = XRegExp("^[\\p{L}\\p{N}\\s\\-_!'&\\(\\)]+$")
 const EMAIL_REGEX = XRegExp('^[\\p{L}\\p{N}.+_-]+@[\\w.-]+$')
+const SPAM_TAGS_REGEX = /qun|jiaqun|jia|jnd/i
+
+function countDigits(str) {
+  return (str.match(/\d/g) || []).length
+}
 
 const SpamSafe = {
   isSafeUserName(name) {
@@ -18,6 +23,10 @@ const SpamSafe = {
   },
 
   isSafeProjectName(name) {
+    if (SPAM_TAGS_REGEX.test(name) || countDigits(name) > 5) {
+      return false
+    }
+
     if (HAN_REGEX.test(name)) {
       return SAFE_REGEX.test(name) && name.length <= 10
     }
diff --git a/services/web/test/unit/src/Email/SpamSafeTests.js b/services/web/test/unit/src/Email/SpamSafeTests.js
index 0af623b3fa..82bbda7607 100644
--- a/services/web/test/unit/src/Email/SpamSafeTests.js
+++ b/services/web/test/unit/src/Email/SpamSafeTests.js
@@ -60,6 +60,12 @@ describe('SpamSafe', function () {
         'A Project'
       )
     ).to.equal('A Project')
+    expect(SpamSafe.safeProjectName(`JND-123456-100s68`, 'A Project')).to.equal(
+      'A Project'
+    )
+    expect(
+      SpamSafe.safeProjectName(`JiAqun123456s100sf68`, 'A Project')
+    ).to.equal('A Project')
     expect(
       SpamSafe.safeEmail('safe-ëmail@domain.com', 'A collaborator')
     ).to.equal('safe-ëmail@domain.com')