Switched from uas_parser.js to ua-parser-js library to improve library management and remove ReDos vulnerabilities. Also improved performance of two native regexes. Thanks to James Davis for raising awareness.

package-lock.json

@@ -10517,6 +10517,11 @@
       "integrity": "sha1-hnrHTjhkGHsdPUfZlqeOxciDB3c=",
       "dev": true
     },
+    "ua-parser-js": {
+      "version": "0.7.17",
+      "resolved": "https://registry.npmjs.org/ua-parser-js/-/ua-parser-js-0.7.17.tgz",
+      "integrity": "sha512-uRdSdu1oA1rncCQL7sCj8vSyZkgtL7faaw9Tc9rZ3mGgraQ7+Pdx7w5mnOSF3gw9ZNG6oc+KXfkon3bKuROm0g=="
+    },
     "uglify-js": {
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/uglify-js/-/uglify-js-3.1.3.tgz",

package.json

@@ -101,6 +101,7 @@
     "sladex-blowfish": "^0.8.1",
     "sortablejs": "^1.7.0",
     "split.js": "^1.3.5",
+    "ua-parser-js": "^0.7.17",
     "utf8": "^3.0.0",
     "vkbeautify": "^0.99.3",
     "xmldom": "^0.1.27",

src/core/ChefWorker.js

@@ -138,6 +138,7 @@ function loadRequiredModules(recipeConfig) {
             log.info("Loading module " + module);
             self.sendStatusMessage("Loading module " + module);
             self.importScripts(self.docURL + "/" + module + ".js");
+            self.sendStatusMessage("");
         }
     });
 }

src/core/Utils.js

@@ -952,7 +952,7 @@ const Utils = {
         // Parse bespoke recipe format
         recipe = recipe.replace(/\n/g, "");
         let m,
-            recipeRegex = /([^(]+)\(((?:'[^'\\]*(?:\\.[^'\\]*)*'|[^)/])*)(\/[^)]+)?\)/g,
+            recipeRegex = /([^(]+)\(((?:'[^'\\]*(?:\\.[^'\\]*)*'|[^)/'])*)(\/[^)]+)?\)/g,
             recipeConfig = [],
             args;
 

src/core/operations/Extract.js

@@ -207,7 +207,7 @@ const Extract = {
      */
     runEmail: function(input, args) {
         let displayTotal = args[0],
-            regex = /\w[-.\w]*@[-\w]+(?:\.[-\w]+)*\.[A-Z]{2,4}/ig;
+            regex = /\b\w[-.\w]*@[-\w]+(?:\.[-\w]+)*\.[A-Z]{2,4}\b/ig;
 
         return Extract._search(input, regex, null, displayTotal);
     },

src/core/operations/HTTP.js

@@ -1,4 +1,4 @@
-import {UAS_parser as UAParser} from "../lib/uas_parser.js";
+import UAParser from "ua-parser-js";
 
 
 /**
@@ -46,20 +46,22 @@ const HTTP = {
      * @returns {string}
      */
     runParseUserAgent: function(input, args) {
-        const ua = UAParser.parse(input);
-
-        return "Type: " + ua.type + "\n" +
-            "Family: " + ua.uaFamily + "\n" +
-            "Name: " + ua.uaName + "\n" +
-            "URL: " + ua.uaUrl + "\n" +
-            "Company: " + ua.uaCompany + "\n" +
-            "Company URL: " + ua.uaCompanyUrl + "\n\n" +
-            "OS Family: " + ua.osFamily + "\n" +
-            "OS Name: " + ua.osName + "\n" +
-            "OS URL: " + ua.osUrl + "\n" +
-            "OS Company: " + ua.osCompany + "\n" +
-            "OS Company URL: " + ua.osCompanyUrl + "\n" +
-            "Device Type: " + ua.deviceType + "\n";
+        const ua = UAParser(input);
+        return `Browser
+    Name: ${ua.browser.name || "unknown"}
+    Version: ${ua.browser.version || "unknown"}
+Device
+    Model: ${ua.device.model || "unknown"}
+    Type: ${ua.device.type || "unknown"}
+    Vendor: ${ua.device.vendor || "unknown"}
+Engine
+    Name: ${ua.engine.name || "unknown"}
+    Version: ${ua.engine.version || "unknown"}
+OS
+    Name: ${ua.os.name || "unknown"}
+    Version: ${ua.os.version || "unknown"}
+CPU
+    Architecture: ${ua.cpu.architecture || "unknown"}`;
     },
 
 

src/core/operations/Regex.js

@@ -32,7 +32,7 @@ const Regex = {
         },
         {
             name: "Email address",
-            value: "(\\w[-.\\w]*)@([-\\w]+(?:\\.[-\\w]+)*)\\.([A-Za-z]{2,4})"
+            value: "\\b(\\w[-.\\w]*)@([-\\w]+(?:\\.[-\\w]+)*)\\.([A-Za-z]{2,4})\\b"
         },
         {
             name: "URL",