[JIRA] (IDP-2065) Remediate UserAgentUtils library out of codebase

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *created* an issue

Identity Provider ( https://shibboleth.atlassian.net/browse/IDP?atlOrigin=eyJpIjoiOWM2OWQ3MGJjZDVkNDE0M2E1YjhmYWI4ODJiYjVhZGYiLCJwIjoiaiJ9 ) / Bug ( https://shibboleth.atlassian.net/browse/IDP-2065?atlOrigin=eyJpIjoiOWM2OWQ3MGJjZDVkNDE0M2E1YjhmYWI4ODJiYjVhZGYiLCJwIjoiaiJ9 ) IDP-2065 ( https://shibboleth.atlassian.net/browse/IDP-2065?atlOrigin=eyJpIjoiOWM2OWQ3MGJjZDVkNDE0M2E1YjhmYWI4ODJiYjVhZGYiLCJwIjoiaiJ9 ) Remediate UserAgentUtils library out of codebase ( https://shibboleth.atlassian.net/browse/IDP-2065?atlOrigin=eyJpIjoiOWM2OWQ3MGJjZDVkNDE0M2E1YjhmYWI4ODJiYjVhZGYiLCJwIjoiaiJ9 )

Issue Type: Bug Affects Versions: 4.0.0, 4.0.1, 4.1.0, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5, 4.1.6, 4.1.7, 4.2.0, 4.2.1 Assignee: Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) Components: Authentication, Logout, User Interface Created: 11/Jan/23 10:45 AM Fix Versions: 5.0.0 Priority: Trivial Reporter: Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 )

We’re stuck on an EOL library, UserAgentUtils, for parsing the UA strings. I believe Marvin Addison ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=70121%3Aa2eef653-9ef6-4d7f-b926-77ec80881594 ) used it to develop a workaround for a Javascript issue in IE, so it may be something we can just move on from, but it’s also in the API in the UserAgentContext.

There’s an open CVE against this library, but like most CVEs, it’s worse than useless and is likely not even accurate, so the bigger issue is just future state.

If it’s not urgent, we’ll deprecate the APIs in V4 and remove them in V5. If it turns out to be worse, we’ll take more aggressive steps before we finalize 4.3 this week.

( https://shibboleth.atlassian.net/browse/IDP-2065#add-comment?atlOrigin=eyJpIjoiOWM2OWQ3MGJjZDVkNDE0M2E1YjhmYWI4ODJiYjVhZGYiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-2065#add-comment?atlOrigin=eyJpIjoiOWM2OWQ3MGJjZDVkNDE0M2E1YjhmYWI4ODJiYjVhZGYiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100213- sha1:b01baad )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20230111/4cec4fb6/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-5d32cb3a-9dda-48a6-b264-ee31935f8ad5
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230111/4cec4fb6/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-2d766476-81ef-4986-b933-5d39a151d9ce
Type: image/png
Size: 446 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230111/4cec4fb6/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-383a96c8-f8a8-40d4-acea-d272e988adb7
Type: image/png
Size: 345 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230111/4cec4fb6/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-5e6675de-6dc9-4fd0-b8f6-e09d98249d16
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230111/4cec4fb6/attachment-0007.png>