Replace ua-parser-js or pin current version

[davidje13]

It seems ua-parser-js has been the source of several security issues:

1. Potentially vulnerable dependency ua-parser-js 0.7.21 #3562 (regex catastrophic backtracking)
2. Security issue: Please update ua-parser-js to 0.7.23 to fix CVE-2020-7793 #3583 (regex catastrophic backtracking)
3. Security issue with ua-parser-js dependency #3680 (regex catastrophic backtracking)
4. ua-parser-js hijacked with a miner #3713 (malware compromise)

The catastrophic backtracking issues of course aren't much of a problem for Karma, but the recent malware compromise certainly is! Karma represents a large chunk of the library's usage (according to NPM, Karma represents ~25% of ua-parser-js's downloads), and since a version range import is being used, it means that Karma may have unwittingly been a big contributor to spreading the latest malware.

Yet the library is only used in a single location for a very minor purpose (constructing a "friendly" name for browsers to show in the logs; as far as I can tell, this is an undocumented internal function with no particular promises about its API):

karma/lib/helper.js

Line 9 in 94cf15e

exports.browserFullNameToShort = (fullName) => {

Maybe it's time to swap that function out for a home-grown simplified version? I think there are a few options:

• handle just the UAs for browsers with supported launchers, and the rest can use the fallback full version string
• don't try to create friendly names for any browsers; just use the full version string for everything
• continue using ua-parser-js, but pin a specific version (0.7.30) instead of a range (^0.7.30) to at least avoid any future compromises being auto-fetched (and perhaps worth doing a quick review of the current code for other issues, if going with this option)
• any of the above, plus make the function configurable (so that users can provide their own full-user-agent -> nice-name function, which could of course use any version of ua-parser-js if the user wants it). If doing this, my preferred choice would be to have the default just pass through the raw UA, removing the need for the dependency and keeping the code simple.

Do the maintainers have any preferences here?

[jginsburgn]

Thanks for bringing this up. I think a home-grown version is the way to go. Can you send a PR?

[davidje13]

sure; will take a look at it this weekend

[jginsburgn]

Sounds great!

[davidje13]

Created a PR

[LucasLopesr]

any news?