github/meteor
1
1
Fork 0
mirror of https://github.com/meteor/meteor.git synced 2026-05-02 03:01:46 -04:00
Code Issues Packages Projects Releases Wiki Activity

Replace useragent with useragent-ng and #13341

Browse Source 
This should mitigate potential ReDoS vulnerability.
This commit is contained in:
Jan Dvorak
2024-09-17 09:51:50 +02:00
parent d251b8dd1a
commit d3d1b9221f
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
packages/webapp/package.js
View File

@@ -13,13 +13,13 @@ Npm.depends({
send: "1.1.0",
"stream-to-string": "1.2.1",
qs: "6.13.0",
useragent: "2.3.0",
"useragent-ng": "2.4.3",
"@types/connect": "3.4.38",
});
Npm.strip({
multiparty: ["test/"],
useragent: ["test/"],
"useragent-ng": ["test/"],
});
// whitelist plugin is now included in the core

4
packages/webapp/webapp_server.js
View File

@@ -10,7 +10,7 @@ import compress from 'compression';
import cookieParser from 'cookie-parser';
import qs from 'qs';
import parseRequest from 'parseurl';
import { lookup as lookupUserAgent } from 'useragent';
import { lookup as lookupUserAgent } from 'useragent-ng';
import { isModern } from 'meteor/modern-browsers';
import send from 'send';
import {
@@ -123,7 +123,7 @@ var camelCase = function(name) {
};
var identifyBrowser = function(userAgentString) {
var userAgent = lookupUserAgent(userAgentString);
var userAgent = lookupUserAgent(userAgentString.substring(0, 150));
return {
name: camelCase(userAgent.family),
major: +userAgent.major,