Denis Demchenko 459d9ea318 Merge commit from fork ...

/Macintosh(.*?) FxiOS(.*?)\// in the OS and platform parsers backtracked
polynomially on a UA with "Macintosh", many " FxiOS" tokens and no
trailing "/", letting a crafted User-Agent stall the event loop.

Utils.isFirefoxOnIpad gives the same result with three indexOf calls.

Fixes GHSA-f9xq-72p3-q9fv


Claude-Session: https://claude.ai/code/session_01Mqhfq6t1iUUprzQDygLDqx

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-26 20:13:21 +02:00

5.0 KiB

Raw Blame History

View Raw