User-Agent detection, history and checklist
hacks.mozilla.org
hacks.mozilla.org
This was one of my first projects in PHP and I naively did not know about never trusting user input and htmlentities().
Queue a couple of weeks later, I get a frantic call from my manager in the middle of the night. One of the customers is making a huge scene that someone hacked his website to put pornography on it. It turns out someone had changed their user-agent to <img src="http://goatse.cx/hello.jpg"> and visited one of our websites...
Assuming the NSA are monitoring the traffic exiting VPN exit points, one minor identity leak by a user (i.e. accessing a website that leaks their identity such as their Facebook profile) would allow the NSA to back-track against any stored traffic using those exact headers.
e.g. NSA db search:
-- Search for 'Junto' traffic exiting VyprVPN London
SELECT [Url],[Timestamp],[Headers],[Ip],[Body],[Response] FROM
HttpTrafficLog
WHERE
UserAgent = 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/29.0.1547.66 Safari/537.36'
AND
AcceptLanguage = 'en-GB,en;q=0.8,de-DE;q=0.6,de;q=0.4,
zh-CN;q=0.2,zh;q=0.2,en-US;q=0.2'
I work on a site that involves fancy uses of video and modals and other things.
For some reason, a recent update to Firefox broke some of the functionality. Testing shows that it involved Firefox on OSX and Flash video. We are using a HTML5 video with Flash fallback library on the site. Almost all browsers, including Firefox on Windows, use HTML5 video on the site and not Flash.
Therefore, I had to use the user-agent to tell me if they were using Firefox and then see if Flash content is used. If so, I fork the functionality to fix the issue for those people. Everyone else gets the original code.
Not an elegant solution but for that edge case it worked. Without knowing the exact browser then I couldn't fix the problem for those users.
There's also a need to know in terms of analytics what browsers are being used to view your sites so you can know what level of functionality you can reasonably expect from your visitors. That is, until all browsers in use render everything, and behave, exactly the same way.
For the second case, you can at least do JS feature detection and send back the results with AJAX. That seems like the "public API" way of getting to know your users' capabilities, rather than trying to infer them from their UA strings.
Interesting idea! I can imagine an implementation--every day, along with updating a malware database, each browser pulls down the list of open bugs on its own bug tracker (and upstream component bug trackers) applying to its own version. Then, from Javascript, you could say something like
if(window.renderer.hasBug("http://trac.webkit.org/3440224")){
/* you're on a version of WebKit affected by this bug */
}