ua-parser-js version 1.0.2 represents a minor update to the widely used User-Agent parsing library, evolving from the previous stable version 1.0.1. Both versions cater to developers needing to identify browser, engine, operating system, CPU, and device characteristics from User-Agent strings in both browser and Node.js environments.
The core functionalities remain consistent, providing essential tools built for user-agent analysis. These versions include detection of parameters, allowing websites and applications to make informed decisions from tailoring content, detecting bots, or optimizing performance based on the end-user device and web browser.
Key differences emerge in the added or updated devDependencies. Version 1.0.2 introduces @babel/parser and @babel/traverse, modules related to the Babel compiler toolchain commonly used in javascript related projects implying potential focus on improving parsing capabilities or enhancing code transformations during development. The update also manifests in a subtle size increase of the unpacked package, now reported to be 328394bytes in v 1.0.2 compared to 327140bytes in v1.0.1. Furthermore, v1.0.2 was released 5 days following v1.0.1.
For developers, the change suggests enhanced support modern javascript features and build pipelines. The continued reliance on testing frameworks like Mocha and code quality tools like JSHint ensures ongoing commitment to stable and reliable code. Developers already using ua-parser-js can likely upgrade to 1.0.2 seamlessly, benefiting from potential improvements and bug fixes embedded within this incremental update.
All the vulnerabilities related to the version 1.0.2 of the package
ReDoS Vulnerability in ua-parser-js version
A regular expression denial of service (ReDoS) vulnerability has been discovered in ua-parser-js.
This vulnerability bypass the library's MAX_LENGTH input limit prevention. By crafting a very-very-long user-agent string with specific pattern, an attacker can turn the script to get stuck processing for a very long time which results in a denial of service (DoS) condition.
All versions of the library prior to version 0.7.33 / 1.0.33.
A patch has been released to remove the vulnerable regular expression, update to version 0.7.33 / 1.0.33 or later.
Regular expression Denial of Service - ReDoS
Thanks to @Snyk who first reported the issue.
