nielsbasjes / yauaa

Yet Another UserAgent Analyzer
https://yauaa.basjes.nl
Apache License 2.0
767 stars 132 forks source link

Fails for a user-agent called "User-Agent" #1557

Closed sbalajirao closed 3 weeks ago

sbalajirao commented 3 weeks ago

Please read this to ensure this is really a bug: https://yauaa.basjes.nl/developer/reportingissues/#these-are-not-bugs

Describe the bug Throws a Java Stack Trace for a user-agent called "User-Agent"

Component where the bug happens [x ] Core analyzer [x] UDF : Snowflake [ ] Other

To Reproduce Steps or code fragment to reproduce the behavior: --Snowflake select util_db.public.udf_parse_useragent(array_construct('User-Agent')); Error

User Error Report: Java Stack Trace: java.lang.IllegalArgumentException: Invalid last element in argument list (was a header name which requires a value to follow) at function_handler_0//nl.basjes.parse.useragent.AnalyzerUtilities.parseArguments(AnalyzerUtilities.java:100) at function_handler_0//nl.basjes.parse.useragent.AnalyzerUtilities.parseArguments(AnalyzerUtilities.java:45) at function_handler_0//nl.basjes.parse.useragent.snowflake.ParseUserAgent.parse(ParseUserAgent.java:46) in function UDF_PARSE_USERAGENT with handler nl.basjes.parse.useragent.snowflake.ParseUserAgent.parse [SQL State=P0000, DB Errorcode=100315] 1 statement failed.

Expected behavior { "AgentClass": "Hacker", "AgentInformationEmail": "Unknown", "AgentName": "Hacker", "AgentNameVersion": "Hacker", "AgentNameVersionMajor": "Hacker", "AgentVersion": "Hacker", "AgentVersionMajor": "Hacker", "DeviceBrand": "Hacker", "DeviceClass": "Hacker", "DeviceName": "Hacker", "DeviceVersion": "Hacker", "HackerAttackVector": "Unknown", "HackerToolkit": "Unknown", "LayoutEngineClass": "Hacker", "LayoutEngineName": "Hacker", "LayoutEngineNameVersion": "Hacker", "LayoutEngineNameVersionMajor": "Hacker", "LayoutEngineVersion": "Hacker", "LayoutEngineVersionMajor": "Hacker", "NetworkType": "Unknown", "OperatingSystemClass": "Hacker", "OperatingSystemName": "Hacker", "OperatingSystemNameVersion": "Hacker", "OperatingSystemNameVersionMajor": "Hacker", "OperatingSystemVersion": "Hacker", "OperatingSystemVersionMajor": "Hacker", "RemarkablePattern": "Hacker", "Useragent": "User-Agent", "WebviewAppName": "Unknown", "WebviewAppNameVersion": "Unknown ??", "WebviewAppNameVersionMajor": "Unknown ??", "WebviewAppVersion": "??", "WebviewAppVersionMajor": "??", "SyntaxError": "false" }

Additional context This is on snowflake, but looking at the Java Stack trace, it is in the core code

nielsbasjes commented 3 weeks ago

What version are you using?

sbalajirao commented 3 weeks ago

yauaa-snowflake-7.27.0-udf.jar

nielsbasjes commented 3 weeks ago

Root cause: User-Agent is the name of a recognized HTTP request header. Because this value is exactly that the system expects a value to follow with the value of that header. But in this case there isn't one.

Work around for you: 2 arguments in the list 'User-Agent' and then the value you have.

nielsbasjes commented 3 weeks ago

Fixed in the next release: https://github.com/nielsbasjes/yauaa/blob/main/udfs/snowflake/src/test/java/nl/basjes/parse/useragent/snowflake/TestParseUserAgent.java#L42-L62

nielsbasjes commented 3 weeks ago

I have released 7.28.0 with this fix.

sbalajirao commented 3 weeks ago

Thank you!