Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update get_crx_url to account for reduced UA entropy #129

Open
Rob--W opened this issue Apr 10, 2023 · 0 comments
Open

Update get_crx_url to account for reduced UA entropy #129

Rob--W opened this issue Apr 10, 2023 · 0 comments

Comments

@Rob--W
Copy link
Owner

Rob--W commented Apr 10, 2023

crxviewer currently relies on navigator.userAgent to extract the version number to forward to the crx download endpoint:

// As of July, the Chrome Web Store sends 204 responses to user agents when their
// Chrome/Chromium version is older than version 31.0.1609.0
var product_version = '9999.0.9999.0';
// Try to detect the Chrome version, and if it is lower than 31.0.1609.0, use a very high version.
// $1 = m.0.r.p // major.minor.revision.patch where minor is always 0 for some reason.
// $2 = m
// $3 = r
var cr_version = /Chrome\/((\d+)\.0\.(\d+)\.\d+)/.exec(navigator.userAgent);
if (cr_version && +cr_version[2] >= 31 && +cr_version[3] >= 1609) {
product_version = cr_version[1];
}

As of today, the logic there is still relevant: The update server responds with 204 if the version is 31.0.1608.0 or lower.
But if the version number is 32.0.0.0 or higher, the server happily accepts the request. This observation is relevant, because currently the logic forcibly falls back to version 9999.0.9999.0 if the major version is lower than 32, or if the build version is lower than 1609. Because navigator.userAgent has been reduced to something like 112.0.0.0, version 9999.0.9999.0 is used unconditionally, even though a lower version number would have been possible too. While there are APIs to get the full version number (i.e. the async navigator.userAgentData.getHighEntropyValues method), it may be sufficient to submit major.0.0.0 when the major version exceeds 31.

More info on User-Agent reduction in Chrome is available at:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant