mirror of
https://github.com/lancedikson/bowser
synced 2026-09-23 04:24:54 +00:00
982a91d5e8
Code scanning (js/polynomial-redos, alerts #16 and #17) ------------------------------------------------------- bowser applies these regexps to attacker-controlled User-Agent strings, and four of them ran in quadratic time: * The "Something else" fallback used /^(.*)\/(.*) / and /^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2). Greedy `(.*)` always picks the last `/` that still has the delimiter after it, so the second group can never span a `/` -- narrowing it to `[^/]*` is exactly equivalent and removes the ambiguity. Verified identical on 1,000,000 fuzzed inputs and on the full acceptance corpus. * The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking is pure waste, but the engine still walks it once per start position, so "linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes it linear; no real bot-name suffix approaches 64 characters. A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling, with the four pre-fix patterns used to confirm the detector works) reports no remaining superlinear regexps. test/unit/redos.js locks this in. Actions (actions/missing-workflow-permissions, alerts #5 and #15) ----------------------------------------------------------------- merge-to-master.yml and draft-or-update-next-release.yml had no `permissions` block and so inherited the default token. Both now declare least privilege, matching publish.yml and pull-request.yml. Dependabot (22 open alerts, all development scope) -------------------------------------------------- bowser ships no runtime dependencies, so none of these reached consumers, but they were live in CI. `pnpm audit` goes from 29 advisories to 0: * jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched release, and picks up current markdown-it/linkify-it. * coveralls -> coveralls-next 6 drops `request`, which is deprecated with no patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2. Same `coveralls` bin and same stdin contract; lcov conversion verified. * gh-pages 3 -> 6 clears the critical prototype pollution advisory. * pnpm overrides pin the remaining transitive-only advisories to the lowest patched release on each existing major. Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus runs against both src/ and the built es5.js), build, package smoke test, and doc generation.
141 lines
3.7 KiB
JSON
141 lines
3.7 KiB
JSON
{
|
|
"name": "bowser",
|
|
"description": "Lightweight browser detector",
|
|
"files": [
|
|
"src",
|
|
"es5.js",
|
|
"bundled.js",
|
|
"bowser.mjs",
|
|
"index.d.ts",
|
|
"index.d.mts"
|
|
],
|
|
"keywords": [
|
|
"browser",
|
|
"useragent",
|
|
"user-agent",
|
|
"parser",
|
|
"ua",
|
|
"detection",
|
|
"ender",
|
|
"sniff"
|
|
],
|
|
"homepage": "https://github.com/bowser-js/bowser",
|
|
"author": "Dustin Diaz <dustin@dustindiaz.com> (http://dustindiaz.com)",
|
|
"contributors": [
|
|
{
|
|
"name": "Denis Demchenko",
|
|
"url": "http://twitter.com/lancedikson"
|
|
},
|
|
{
|
|
"name": "Naor Peled",
|
|
"url": "https://github.com/naorpeled"
|
|
}
|
|
],
|
|
"main": "es5.js",
|
|
"browser": "es5.js",
|
|
"module": "src/bowser.js",
|
|
"types": "index.d.ts",
|
|
"exports": {
|
|
".": {
|
|
"import": {
|
|
"types": "./index.d.mts",
|
|
"default": "./bowser.mjs"
|
|
},
|
|
"require": {
|
|
"types": "./index.d.ts",
|
|
"default": "./es5.js"
|
|
},
|
|
"default": "./es5.js"
|
|
},
|
|
"./es5.js": "./es5.js",
|
|
"./es5": "./es5.js",
|
|
"./bundled.js": "./bundled.js",
|
|
"./bundled": "./bundled.js",
|
|
"./bowser.mjs": {
|
|
"types": "./index.d.mts",
|
|
"default": "./bowser.mjs"
|
|
},
|
|
"./src/bowser.js": "./src/bowser.js",
|
|
"./src/bowser": "./src/bowser.js",
|
|
"./src/constants.js": "./src/constants.js",
|
|
"./src/constants": "./src/constants.js",
|
|
"./src/parser.js": "./src/parser.js",
|
|
"./src/parser": "./src/parser.js",
|
|
"./src/parser-browsers.js": "./src/parser-browsers.js",
|
|
"./src/parser-browsers": "./src/parser-browsers.js",
|
|
"./src/parser-engines.js": "./src/parser-engines.js",
|
|
"./src/parser-engines": "./src/parser-engines.js",
|
|
"./src/parser-os.js": "./src/parser-os.js",
|
|
"./src/parser-os": "./src/parser-os.js",
|
|
"./src/parser-platforms.js": "./src/parser-platforms.js",
|
|
"./src/parser-platforms": "./src/parser-platforms.js",
|
|
"./src/utils.js": "./src/utils.js",
|
|
"./src/utils": "./src/utils.js",
|
|
"./package.json": "./package.json"
|
|
},
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "git+https://github.com/bowser-js/bowser.git"
|
|
},
|
|
"devDependencies": {
|
|
"@arethetypeswrong/cli": "^0.18.5",
|
|
"@babel/cli": "^7.29.7",
|
|
"@babel/core": "^7.29.7",
|
|
"@babel/preset-env": "^7.29.7",
|
|
"@babel/register": "^7.29.7",
|
|
"@eslint/js": "^10.0.1",
|
|
"@rolldown/plugin-babel": "0.2.3",
|
|
"ava": "^3.0.0",
|
|
"babel-plugin-add-module-exports": "^1.0.4",
|
|
"babel-plugin-istanbul": "^8.0.0",
|
|
"core-js": "^3.49.0",
|
|
"coveralls-next": "^6.0.2",
|
|
"docdash": "^2.0.2",
|
|
"eslint": "^10.8.0",
|
|
"eslint-config-airbnb-extended": "^3.1.0",
|
|
"eslint-plugin-ava": "^17.0.1",
|
|
"eslint-plugin-import": "^2.32.0",
|
|
"gh-pages": "^6.3.0",
|
|
"jsdoc": "^4.0.5",
|
|
"nyc": "^18.0.0",
|
|
"publint": "^0.3.22",
|
|
"regenerator-runtime": "^0.14.1",
|
|
"sinon": "^22.0.0",
|
|
"terser": "^5.49.0",
|
|
"testem": "^3.20.2",
|
|
"tsdown": "^0.22.14",
|
|
"typescript": "^5.9.3",
|
|
"yamljs": "^0.3.0"
|
|
},
|
|
"ava": {
|
|
"require": [
|
|
"@babel/register"
|
|
],
|
|
"files": [
|
|
"test/**/*.js",
|
|
"!test/package/**"
|
|
]
|
|
},
|
|
"bugs": {
|
|
"url": "https://github.com/bowser-js/bowser/issues"
|
|
},
|
|
"directories": {
|
|
"test": "test"
|
|
},
|
|
"scripts": {
|
|
"build": "tsdown",
|
|
"generate-and-deploy-docs": "pnpm generate-docs && gh-pages --dist docs --dest docs",
|
|
"watch": "tsdown --watch",
|
|
"lint:check": "eslint ./src",
|
|
"lint:fix": "eslint --fix ./src",
|
|
"testem": "testem",
|
|
"test": "nyc --reporter=html --reporter=text ava",
|
|
"test:watch": "ava --watch",
|
|
"test:package": "node test/package/smoke.cjs",
|
|
"coverage": "nyc report --reporter=text-lcov | coveralls",
|
|
"generate-docs": "jsdoc -c jsdoc.json"
|
|
},
|
|
"license": "MIT",
|
|
"packageManager": "pnpm@11.18.0"
|
|
}
|