mjc-gh / badbrowser Goto Github PK

What if we can't ID the version but we at least know (or think) it's browser X. Do we set the right instance var in the UA lib or do nothing at all?

The following versions cause issue with comparisons because they do not have trailing zero (5.21 vs 5.2... should be 5.20?). Not sure how to handle these. For now I've commented them out in the fixture file:

'5.23':
  - Mozilla/4.0 (compatible; MSIE 5.23; Mac_PowerPC)
'5.22':
  - Mozilla/4.0 (compatible; MSIE 5.22; Mac_PowerPC)
'5.21':
  - Mozilla/4.0 (compatible; MSIE 5.21; Mac_PowerPC)
'5.2':
  - Mozilla/4.0 (compatible; MSIE 5.2; Mac_PowerPC)
'5.17':
  - Mozilla/4.0 (compatible; MSIE 5.17; Mac_PowerPC)
  - Mozilla/4.0 (compatible; MSIE 5.17; Mac_PowerPC Mac OS; en)
'5.16':
  - Mozilla/4.0 (compatible; MSIE 5.16; Mac_PowerPC)
'5.15':
  - Mozilla/4.0 (compatible; MSIE 5.15; Mac_PowerPC)
  - Mozilla/4.0 (compatible; MSIE 5.15; Mac_PowerPC)
'5.14':
  - Mozilla/4.0 (compatible; MSIE 5.14; Mac_PowerPC)
'5.13':
  - Mozilla/4.0 (compatible; MSIE 5.13; Mac_PowerPC)
'5.12':
  - Mozilla/4.0 (compatible; MSIE 5.12; Mac_PowerPC)

We need to log often and completely so we know if we miss a user-agent. Ideally, we can just throw some rather verbose logging into the AgentDetector class however, I do not want to handicap performance for the goal of logging.

That being said, it's probably best to just log externally from the class itself and always record the results parsing. That way if we miss something (say a older Safari UA that our map doesn't account for), we know we missed it and can fix the class accordingly.

We don't want to send any false positives on Mobile Agents. I'm not sure how similar their UA strings. I'm particularly worried about Firefox Mobile.

The best line of defense against though, is to document that the API should not be used with mobile templates. It's not for mobile (yet).

We need to test the AgentDetector class needs some test that throw it some really hard parse strings. Likewise, we need input that tries to trip up its logic (Opera and Safari in particular). Finally, we need a set of test with downright malicious input (like really long strings or strings that give the regex potential problems)

Safari UA strings version 3.0 and later are like the following:
Mozilla/5.0 (Windows; U; Windows NT 5.1; fr-FR) AppleWebKit/523.15 (KHTML, like Gecko) Version/3.0 Safari/523.15

Prior versions do no include the Version token and like the following:

2.0.4:
  Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/418.8 (KHTML, like Gecko) Safari/419.3

2.0.3:
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/418 (KHTML, like Gecko) Safari/417.9.3

The good thing these versions are likely to be marked as "bad" (out-of-date and should be updated for security\usability reasons). Likewise, it seems like each Safari token has a unique number that can be mapped to the precise version.

The bad thing is, we'd need to a lookup map to get the version. It's not the end of the world but it's a less than ideal solution.

Sometimes an Opera user-agent will not include a trailing zero. For example:

Opera 9.4 (Windows NT 6.1; U; en)
Opera/9.80 (S60; SymbOS; Opera Tablet/9174; U; en) Presto/2.7.81 Version/10.5

I'm not entirely sure how we should handle this. Here are some ideas:

1. Ignore this instances (comment them out) in the fixture file and just not worry about it.

2. If we don't detect a double digit on the Opera string, we add a zero. The scheme for Opera versions is rather consistent and this type of logic should work just fine (for example: 10.00 appears as Version/10.00). We need would just need to alter the fixtures to include this fix.

Optimize any and all regex. This will likely be a standing issue. Always remember to run the tests after tweaking a regex to make sure something else didn't break.

As a matter of policy more than anything else, we need to decide what to do if we positively match a browser but no version. For example consider these UA strings:

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.19) Gecko/20081202 Firefox (Debian-2.0.0.19-0etch1)
Mozilla/5.0 (X11; U; Gentoo Linux x86_64; pl-PL) Gecko Firefox
Mozilla/5.0 (X11; ; Linux x86_64; rv:1.8.1.6) Gecko/20070802 Firefox

They are clearly Firefox, but no specific version. Thoughts?