Archives/lancedikson_bowser
1
0
Fork 0
mirror of https://github.com/lancedikson/bowser synced 2026-09-23 20:44:24 +00:00
Code Issues Releases Wiki Activity

fix: resolve open GitHub security findings

Browse Source 
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:

  * The "Something else" fallback used /^(.*)\/(.*) / and
    /^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
    make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
    Greedy `(.*)` always picks the last `/` that still has the delimiter
    after it, so the second group can never span a `/` -- narrowing it to
    `[^/]*` is exactly equivalent and removes the ambiguity. Verified
    identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.

  * The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
    required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
    is pure waste, but the engine still walks it once per start position, so
    "linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
    it linear; no real bot-name suffix approaches 64 characters.

A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.

Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.

Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:

  * jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
    release, and picks up current markdown-it/linkify-it.
  * coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
    patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
    Same `coveralls` bin and same stdin contract; lcov conversion verified.
  * gh-pages 3 -> 6 clears the critical prototype pollution advisory.
  * pnpm overrides pin the remaining transitive-only advisories to the lowest
    patched release on each existing major.

Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
This commit is contained in:
naorpeled
2026-08-30 20:37:19 +03:00
parent a88622557d
commit 982a91d5e8
7 changed files with 322 additions and 563 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/parser-browsers.js
View File

@@ -273,7 +273,8 @@ const browsersList = [
const browser = {
name: 'Linespider',
};
const version = Utils.getFirstMatch(/(?:linespider)(?:-[-\w]+)?[\s/](\d+(\.\d+)+)/i, ua) || Utils.getFirstMatch(commonVersionIdentifier, ua);
// `{1,64}` bounds the backtracking: unbounded, a repeated-token UA is quadratic.
const version = Utils.getFirstMatch(/(?:linespider)(?:-[-\w]{1,64})?[\s/](\d+(\.\d+)+)/i, ua) || Utils.getFirstMatch(commonVersionIdentifier, ua);
if (version) {
browser.version = version;
@@ -385,7 +386,8 @@ const browsersList = [
const browser = {
name: 'SlackBot',
};
const version = Utils.getFirstMatch(/(?:slackbot|slack-imgproxy)(?:-[-\w]+)?[\s/](\d+(\.\d+)+)/i, ua) || Utils.getFirstMatch(commonVersionIdentifier, ua);
// `{1,64}` bounds the backtracking: unbounded, a repeated-token UA is quadratic.
const version = Utils.getFirstMatch(/(?:slackbot|slack-imgproxy)(?:-[-\w]{1,64})?[\s/](\d+(\.\d+)+)/i, ua) || Utils.getFirstMatch(commonVersionIdentifier, ua);
if (version) {
browser.version = version;
@@ -1232,8 +1234,8 @@ const browsersList = [
* in order to decide what regexp exactly we want to apply
* (as there is a specific decision based on that conclusion)
*/
const regexpWithoutDeviceSpec = /^(.*)\/(.*) /;
const regexpWithDeviceSpec = /^(.*)\/(.*)[ \t]\((.*)/;
const regexpWithoutDeviceSpec = /^(.*)\/([^/]*) /;
const regexpWithDeviceSpec = /^(.*)\/([^/]*)[ \t]\((.*)/;
const hasDeviceSpec = ua.search('\\(') !== -1;
const regexp = hasDeviceSpec ? regexpWithDeviceSpec : regexpWithoutDeviceSpec;
return {