Version 0.7.31 of ua-parser-js introduces notable changes compared to its predecessor, version 0.7.30, primarily in its development dependencies. Specifically, version 0.7.31 incorporates @babel/parser (version 7.15.8) and @babel/traverse (version 7.15.4) as new devDependencies. These additions suggest an update to the codebase's build or testing process, potentially involving more modern JavaScript syntax or advanced code transformations handled by Babel.
For developers using the library, the core functionality of parsing User-Agent strings to identify browsers, engines, operating systems, CPUs, and device types remains consistent between the two versions. The description highlights the library's dual environment support—both browser and Node.js—making it versatile for various projects. Both versions share the same MIT license, author, repository, and funding links, ensuring continuity in usage rights and contributing options. The dist object showcases slight differences in unpackedSize, with v0.7.31 being marginally larger, probably because of the added dev dependencies adding to the overall size. The release dates also differ, with version 0.7.31 released a few days after 0.7.30. Developers should evaluate if the updated dev dependencies in v0.7.31 align better with their existing toolchain or if v0.7.30 suffices for their User-Agent parsing needs.
All the vulnerabilities related to the version 0.7.31 of the package
ReDoS Vulnerability in ua-parser-js version
A regular expression denial of service (ReDoS) vulnerability has been discovered in ua-parser-js
.
This vulnerability bypass the library's MAX_LENGTH
input limit prevention. By crafting a very-very-long user-agent string with specific pattern, an attacker can turn the script to get stuck processing for a very long time which results in a denial of service (DoS) condition.
All versions of the library prior to version 0.7.33
/ 1.0.33
.
A patch has been released to remove the vulnerable regular expression, update to version 0.7.33
/ 1.0.33
or later.
Regular expression Denial of Service - ReDoS
Thanks to @Snyk who first reported the issue.