https://kotlinlang.org logo
Join Slack
Powered by
IMPORTANT. PLEASE READ: ua-parser-js exploit and K...
# announcements
h
IMPORTANT. PLEASE READ: ua-parser-js exploit and Kotlin/JS. https://blog.jetbrains.com/kotlin/2021/10/important-ua-parser-js-exploit-and-kotlin-js/
➕ 3
🙏 20
o
When searching for installed versions of 
ua-parser-js
on Linux, the 
grep
command mentioned gave me no results. I had more success with this command line (with 
{x}
being replaced by the start directories to search): 
find {x} -mount -iname \*ua-parser-js\* -exec grep -H -i version '{}/package.js' \;
h
Hmm. I tested this multiple times and it seemed to work for me….
But thanks. I’ll update post to also mention yours
o
Did some research. The only 
package.json
with a match was one in a npm repository under 
~/npm
. The format differed in that there was no space between the 
"_id":
and 
"ua-parser-js
. So the following grep variant would fix that and should find both versions: 
grep -r --include=package.json '"_id": *"ua-parser-js' {x}
The 
package.js
files were all in 
build/js/node_modules
directories of several Kotlin multiplatform projects. Each of them had a 
package.json
at its side, but with a different format (multi-line instead of single line, and the 
"_id"
key was missing). This command line would find them all via their 
package.json
manifest files, regardless of format, and print out the respective version: 
grep -E -r -l --include=package.json '"(_id|name)": *"ua-parser-js' {x} | xargs grep -E -m 1 -o '"version": *"[0-9][^"]*"'
🙏 1
h
Hm. That’s not finding all instances on my machine…
(or should I say outputting)
j
Possibly indicates need for channel "security-announcements" - as I'd much rather pay attention to a compromise announcement than a mascot competition.
😄 3
o
@hhariri That seems strange. I suppose you have replaced the 
{x}
as usual, even though it appears in the middle of the command line. An easier invocation would be this one (which also prints the path correctly if only a single file is found): 
start_dir={x}; grep -E -r -l --include=package.json '"(_id|name)": *"ua-parser-js' "$start_dir" | xargs grep -EH -m 1 -o '"version": *"[0-9][^"]*"'
Example 1 (npm repo):
Copy code
$ start_dir=.npm; grep -E -r -l --include=package.json '"(_id|name)": *"ua-parser-js' "$start_dir" | xargs grep -EH -m 1 -o '"version": *"[0-9][^"]*"'
.npm/ua-parser-js/0.7.24/package/package.json:"version":"0.7.24"
Example 2 (Kotlin projects):
Copy code
$ start_dir=Repositories/experimental.nobackup; grep -E -r -l --include=package.json '"(_id|name)": *"ua-parser-js' "$start_dir" | xargs grep -EH -m 1 -o '"version": *"[0-9][^"]*"'
Repositories/experimental.nobackup/kotlinx.html/build/js/node_modules/ua-parser-js/package.json:"version": "0.7.21"
Repositories/experimental.nobackup/Issues/kotlin-coroutines-cancellation/build/js/node_modules/ua-parser-js/package.json:"version": "0.7.28"
Repositories/experimental.nobackup/Issues/KT-46340-repro/test/build/js/node_modules/ua-parser-js/package.json:"version": "0.7.28"
Repositories/experimental.nobackup/markdown-editor-mono/build/js/node_modules/ua-parser-js/package.json:"version": "0.7.28"
Repositories/experimental.nobackup/PeopleInSpace/build/js/node_modules/ua-parser-js/package.json:"version": "0.7.28"
Repositories/experimental.nobackup/kotlin-multiplatform-test-gutters/build/js/node_modules/ua-parser-js/package.json:"version": "0.7.28"
As the version mentioned in the blog post does not find the files in Kotlin projects, maybe it's worth to check again for completeness.
One idea: If you ran your checks on MacOS, it could be that its 
grep
supports a different set of options. I'll try to check...
After checking the following sources, it appears that MacOS's BSD grep and xargs support all the options used above. • https://ss64.com/osx/grep.html • https://ss64.com/osx/xargs.html If it's still not working, could you provide some details?
10 Views
Open in Slack
PreviousNext
Powered by