1
0
mirror of https://github.com/lancedikson/bowser synced 2026-09-23 04:24:54 +00:00
naorpeled 982a91d5e8 fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:

  * The "Something else" fallback used /^(.*)\/(.*) / and
    /^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
    make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
    Greedy `(.*)` always picks the last `/` that still has the delimiter
    after it, so the second group can never span a `/` -- narrowing it to
    `[^/]*` is exactly equivalent and removes the ambiguity. Verified
    identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.

  * The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
    required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
    is pure waste, but the engine still walks it once per start position, so
    "linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
    it linear; no real bot-name suffix approaches 64 characters.

A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.

Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.

Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:

  * jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
    release, and picks up current markdown-it/linkify-it.
  * coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
    patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
    Same `coveralls` bin and same stdin contract; lcov conversion verified.
  * gh-pages 3 -> 6 clears the critical prototype pollution advisory.
  * pnpm overrides pin the remaining transitive-only advisories to the lowest
    patched release on each existing major.

Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 21:00:59 +03:00
2019-01-07 00:23:01 +02:00
2018-07-17 21:10:09 +03:00
2017-06-08 22:23:27 +03:00
2023-11-13 11:11:43 +02:00
2018-07-08 12:09:27 +03:00
2015-07-25 18:56:12 -07:00

Bowser

A small, fast and rich-API browser/platform/engine detector for both browser and node.

  • Small. Use plain ES5-version which is ~4.8kB gzipped.
  • Optimized. Use only those parsers you need — it doesn't do useless work.
  • Multi-platform. It's browser- and node-ready, so you can use it in any environment.

Don't hesitate to support the project on Github or OpenCollective if you like it ❤️ Also, contributors are always welcome!

Financial Contributors on Open Collective Downloads

Contents

Overview

The library is made to help to detect what browser your user has and gives you a convenient API to filter the users somehow depending on their browsers. Check it out on this page: https://bowser-js.github.io/bowser-online/.

⚠️ Version 2.0 breaking changes ⚠️

Version 2.0 has drastically changed the API. All available methods are on the docs page.

For legacy code, check out the 1.x branch and install it through npm install bowser@1.9.4.

Use cases

First of all, require the library. Bowser is a dual package: require resolves to a UMD build (which also works for AMD and as a plain <script> tag), and import resolves to a real ES module.

const Bowser = require("bowser"); // CommonJS

import * as Bowser from "bowser"; // TypeScript

import Bowser from "bowser"; // ES6 (and TypeScript with --esModuleInterop enabled)

The ES module build also exposes parse and getParser as named exports, so you can import just the part you use and let your bundler drop the rest:

import { getParser, parse } from "bowser";

const browser = getParser(window.navigator.userAgent);

Loaded from a CDN or a <script> tag, Bowser attaches itself to the global as bowser (lowercase):

<script src="https://unpkg.com/bowser@2/es5.js"></script>
<script>
  console.log(bowser.parse(window.navigator.userAgent));
</script>

By default, the exported version is the ES5 transpiled version, which do not include any polyfills.

In case you don't use your own polyfills you may need to have pre-built bundle with all needed polyfills. So, for you it's suitable to require bowser like this: require('bowser/bundled'). As the result, you get a ES5 version of bowser with core-js polyfills bundled together.

You may need to use the source files, so they will be available in the package as well.

Browser props detection

Often we need to pick users' browser properties such as the name, the version, the rendering engine and so on. Here is an example how to do it with Bowser:

const browser = Bowser.getParser(window.navigator.userAgent);

console.log(`The current browser name is "${browser.getBrowserName()}"`);
// The current browser name is "Internet Explorer"

Using User-Agent Client Hints

Modern browsers support User-Agent Client Hints, which provide a more privacy-friendly and structured way to access browser information. Bowser can use Client Hints data to improve browser detection accuracy.

// Pass Client Hints as the second parameter
const browser = Bowser.getParser(
  window.navigator.userAgent,
  window.navigator.userAgentData
);

console.log(`The current browser name is "${browser.getBrowserName()}"`);
// More accurate detection using Client Hints

Working with Client Hints

Bowser provides methods to access and query Client Hints data:

const browser = Bowser.getParser(
  window.navigator.userAgent,
  window.navigator.userAgentData
);

// Get the full Client Hints object
const hints = browser.getHints();
// Returns the ClientHints object or null if not provided

// Check if a specific brand exists
if (browser.hasBrand('Google Chrome')) {
  console.log('This is Chrome!');
}

// Get the version of a specific brand
const chromeVersion = browser.getBrandVersion('Google Chrome');
console.log(`Chrome version: ${chromeVersion}`);

The Client Hints object structure:

{
  brands: [
    { brand: 'Google Chrome', version: '131' },
    { brand: 'Chromium', version: '131' },
    { brand: 'Not_A Brand', version: '24' }
  ],
  mobile: false,
  platform: 'Windows',
  platformVersion: '15.0.0',
  architecture: 'x86',
  model: '',
  wow64: false
}

Note: Client Hints improve detection for browsers like DuckDuckGo and other Chromium-based browsers that may have similar User-Agent strings. When Client Hints are not provided, Bowser falls back to standard User-Agent string parsing.

or

const browser = Bowser.getParser(window.navigator.userAgent);
console.log(browser.getBrowser());

// outputs
{
  name: "Internet Explorer"
  version: "11.0"
}

or

console.log(Bowser.parse(window.navigator.userAgent));

// outputs
{
  browser: {
    name: "Internet Explorer"
    version: "11.0"
  },
  os: {
    name: "Windows"
    version: "NT 6.3"
    versionName: "8.1"
  },
  platform: {
    type: "desktop"
  },
  engine: {
    name: "Trident"
    version: "7.0"
  }
}

You can also use Bowser.parse() with Client Hints:

console.log(Bowser.parse(window.navigator.userAgent, window.navigator.userAgentData));

// Same output structure, but with enhanced detection from Client Hints

Filtering browsers

You could want to filter some particular browsers to provide any special support for them or make any workarounds. It could look like this:

const browser = Bowser.getParser(window.navigator.userAgent);
const isValidBrowser = browser.satisfies({
  // declare browsers per OS
  windows: {
    "internet explorer": ">10",
  },
  macos: {
    safari: ">10.1"
  },

  // per platform (mobile, desktop or tablet)
  mobile: {
    safari: '>=9',
    'android browser': '>3.10'
  },

  // or in general
  chrome: "~20.1.1432",
  firefox: ">31",
  opera: ">=22",

  // also supports equality operator
  chrome: "=20.1.1432", // will match particular build only

  // and loose-equality operator
  chrome: "~20",        // will match any 20.* sub-version
  chrome: "~20.1"       // will match any 20.1.* sub-version (20.1.19 as well as 20.1.12.42-alpha.1)
});

Settings for any particular OS or platform has more priority and redefines settings of standalone browsers. Thus, you can define OS or platform specific rules and they will have more priority in the end.

More of API and possibilities you will find in the docs folder.

Browser names for .satisfies()

By default you are supposed to use the full browser name for .satisfies. But, there's a short way to define a browser using short aliases. The full list of aliases can be found in the file.

Similar Projects

  • Kong - A C# port of Bowser.

Contributors

Code Contributors

This project exists thanks to all the people who contribute. [Contribute].

Financial Contributors

Become a financial contributor and help us sustain our community. [Contribute]

Individuals

Organizations

Support this project with your organization. Your logo will show up here with a link to your website. [Contribute]

License

Licensed as MIT. All rights not explicitly granted in the MIT license are reserved. See the included LICENSE file for more details.

Description
No description provided
Readme 18 MiB
Languages
JavaScript 93.4%
TypeScript 6.6%