browser_sniffer 2.5.1 → 2.5.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 063bbcdba6a86e10804f3685bfd18cca2171abba2283deeb36ec52faec7a09eb
-  data.tar.gz: 7cfac68c97ffb4b1103b1a794fdf16b87dee8028c68618fdfa89bbdbf08c7c39
+  metadata.gz: f1fa6f0ef701270fad08c72634ccbb5c9a01a8748eb5368ccff0d62066065c9a
+  data.tar.gz: 7915b883d825b1776b6833ea89cdde0be71ebed046fd06e73627cdc6b52c07ad
 SHA512:
-  metadata.gz: 448d4bdecf7bc7fc1f71c493f72fe819ae1ec8be3c3f0edb26f04d3b8ac0a210451f1554a6c368a0392b31d4a2c0afe142454f38efc0ea1c779d2691ccbc057b
-  data.tar.gz: c45d7149bd168e6e74bede798620ea823bba03dfe174f737b56799fa424635daa705bd8490afa4b4358d5a67d71b37bbe67d7be4773309d3931477381fd4bf4f
+  metadata.gz: 53940f3356cabe18354c764930c2acbfb0e09c884147d63e5556f139c41df51a0c437fa05b77bf50a10e117e6d3aec2a8f2e4450be2f762a909e2ac9f64eb8ab
+  data.tar.gz: 6cb0b817ae2c25c0163d7a70e6db1952878ce2a96d19981d158b0de53d45943d587584ff64e66076c1b5e5d68cfc47ad7e2c220babff87e4ffe5c0aba4f3efa1

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    browser_sniffer (2.5.1)
+    browser_sniffer (2.5.2)
 
 GEM
   remote: https://rubygems.org/

data/lib/browser_sniffer/patterns.rb

@@ -222,10 +222,10 @@ class BrowserSniffer
         %r{.*Shopify POS\/[\d\.]+ \((iPod touch)\;.*Scale/([\d\.]+)}i,
       ], [[:type, :handheld], :scale], [
         # Shopify POS for Android (SmartWebView)
-        %r{.*Shopify\sPOS.*\(.*(Android)\s[\d\.]+\;\s(.*)\sBuild/.*\)\sPOS.*[\d+\.]+}i,
+        %r{.*Shopify\sPOS[^\(]*\((?:[^()]*)(Android)\s[\d\.]+\;\s(?:[^;()]*\;\s)*([^;()]*)\sBuild/[^)]*\)\sPOS[^\d]*[\d+\.]+}i,
       ], [[:type, :handheld], :model], [
         # Shopify POS for Android (Native App)
-        %r{.*\(.*(Android)\s[\d\.]+\;\s(.*)\sBuild/.*\)\sPOS.*[\d+\.]+}i,
+        %r{.*\((?:[^()]*)(Android)\s[\d\.]+\;\s(?:[^;()]*\;\s)*([^;()]*)\sBuild/[^)]*\)\sPOS[^\d]*[\d+\.]+}i,
       ], [[:type, :handheld], :model], [
         # New tablet patterns (must come early to avoid generic matches)
         # Xiaomi Tablets
@@ -496,7 +496,7 @@ class BrowserSniffer
         # BSD based
         /\s([frentopc-]{0,4}bsd|dragonfly)\s?([\w\.]+)*/i # FreeBSD/NetBSD/OpenBSD/PC-BSD/DragonFly
       ], [:name, :version],[
-        /(ip[honead]+)(?:.*os\s*([\w]+)*\slike\smac|;\sopera)/i # iOS
+        /(ip[honead]+)(?:.*os\s*([\w]+)\slike\smac|;\sopera)/i # iOS
       ], [[:name, 'iOS'], [:version, lambda {|str| str && str.gsub(/_/, '.') }], [:type, :ios]], [
         /(mac\sos\sx)\s?([\w\s\.]+\w)*/i # Mac OS
       ], [:name, [:version, lambda {|str| str && str.gsub(/_/, '.') }], [:type, :mac]], [

data/lib/browser_sniffer/version.rb

@@ -1,3 +1,3 @@
 class BrowserSniffer
-  VERSION = "2.5.1"
+  VERSION = "2.5.2"
 end

data/lib/browser_sniffer.rb

@@ -2,10 +2,16 @@ require "browser_sniffer/version"
 require "browser_sniffer/patterns"
 
 class BrowserSniffer
+  MAX_USER_AGENT_LENGTH = 512
+
   attr_reader :user_agent
 
   def initialize(user_agent)
-    @user_agent = user_agent
+    @user_agent = if user_agent.is_a?(String)
+      user_agent[0, MAX_USER_AGENT_LENGTH]
+    else
+      user_agent
+    end
   end
 
   def ios?

data/test/browser_sniffer_test.rb

@@ -1439,8 +1439,70 @@ class BrowserSnifferTest < Minitest::Test
       :device_vendor => 'Onyx',
       :device_name => 'NoteAir3C',
     },
+    :shopify_pos_android_native => {
+      :user_agent => "Mozilla/5.0 (Linux; Android 10; SM-G973U Build/QP1A.190711.020) POS 1.0",
+      :form_factor => :handheld,
+      :ios? => false,
+      :android? => true,
+      :desktop? => false,
+      :os => :android,
+      :os_version => "10",
+      :device_name => 'SM-G973U',
+    },
+    :shopify_pos_android_native_with_locale => {
+      :user_agent => "Mozilla/5.0 (Linux; U; Android 7.1.1; en-US; SM-T560NU Build/NMF26X) POS 2.4.10",
+      :form_factor => :handheld,
+      :ios? => false,
+      :android? => true,
+      :desktop? => false,
+      :os => :android,
+      :os_version => "7.1.1",
+      :device_name => 'SM-T560NU',
+    },
+    :shopify_pos_android_smartwebview => {
+      :user_agent => "Shopify POS/1.0 Mozilla/5.0 (Linux; Android 10; SM-G973U Build/QP1A.190711.020) POS 1.0",
+      :form_factor => :handheld,
+      :ios? => false,
+      :android? => true,
+      :desktop? => false,
+      :os => :android,
+      :os_version => "10",
+      :device_name => 'SM-G973U',
+    },
+    :shopify_pos_android_smartwebview_with_locale => {
+      :user_agent => "Shopify POS/2.4.10 Mozilla/5.0 (Linux; U; Android 7.1.1; en-US; SM-T560NU Build/NMF26X) POS 2.4.10",
+      :form_factor => :handheld,
+      :ios? => false,
+      :android? => true,
+      :desktop? => false,
+      :os => :android,
+      :os_version => "7.1.1",
+      :device_name => 'SM-T560NU',
+    },
   }
 
+  def test_nil_user_agent_is_preserved
+    assert_nil BrowserSniffer.new(nil).user_agent
+  end
+
+  def test_user_agent_length_is_capped
+    long_user_agent = "a" * 10_000
+    sniffer = BrowserSniffer.new(long_user_agent)
+    assert_equal BrowserSniffer::MAX_USER_AGENT_LENGTH, sniffer.user_agent.length
+  end
+
+  def test_pos_android_regex_does_not_backtrack_catastrophically
+    malicious_user_agent = ("(Android 1.0; a Build/" * 160) + "!"
+    time = Benchmark.realtime { BrowserSniffer.new(malicious_user_agent).form_factor }
+    assert time < 0.1, "Expected POS Android regex to reject crafted UA quickly, took #{time}s"
+  end
+
+  def test_ios_os_regex_does_not_backtrack_catastrophically
+    malicious_user_agent = "iphone os " + ("a" * 320) + "!"
+    time = Benchmark.realtime { BrowserSniffer.new(malicious_user_agent).os }
+    assert time < 0.1, "Expected iOS OS regex to reject crafted UA quickly, took #{time}s"
+  end
+
   AGENTS.each do |agent, attributes|
     define_method "test_sniff_#{agent}_correctly" do
       sniffer = BrowserSniffer.new(attributes[:user_agent])

data/test/test_helper.rb

@@ -1,5 +1,6 @@
 $VERBOSE = true
 
+require 'benchmark'
 require 'minitest/autorun'
 
 require "#{File.dirname(__FILE__)}/../init"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: browser_sniffer
 version: !ruby/object:Gem::Version
-  version: 2.5.1
+  version: 2.5.2
 platform: ruby
 authors:
 - Shopify