bcgov / bcgov/SecurityAwareness

JS bug, presumably in upstream dependency, breaking initial load in SecurityAwareness/PublicISA

Open
#7 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
HTML
Stars
17
Forks
5
PR merge metrics
No merged PRs in 30d

Description

A bug in the [Security Awareness course](https://bcgov.github.io/SecurityAwareness/ISAPublic/story_html5.html), linked from the [BC government infosec pro-D page](https://www2.gov.bc.ca/gov/content/governments/services-for-government/information-management-technology/information-security/professional-development/information-security-online-course), initially prevents the course from loading in Firefox. In the minified JS file [app.min.js](/bcgov/SecurityAwareness/blob/master/ISAPublic/html5/lib/scripts/app.min.js), at what becomes line 40829 upon prettifying using the current Firefox Dev Tools, a string is assigned to a variable if the lowercase of the DOM-provided user-agent string contains “firefox”, where a function should be assigned instead. Particularly, where the prettified version of minified code reads:
```js
n = u.isFF() ? 'window.setTimeout' : function (e) {
return e()
};
```
it should instead read:
```js
n = u.isFF() ? window.setTimeout : function (e) {
return e()
};
```
so the value of `n` would become the built-in function `window.setTimeout`, not the string `'window.setTimeout'`.

Uncorrected, this causes the script to fail with a `TypeError` at what becomes line 40843 (as above), when `n` is called as a function, as follows:
```js
n(function () {
i && (f = m(), e())
}, 250)
```

Patching the code as above resolves the bug. (So does spoofing the UA string of any desktop browser besides Firefox.) The bug would of course have to be fixed in the original, un-minified code. To that end, I would’ve forked the repository and filed a PR for this, but the un-minified version of the code in question does not appear to exist anywhere in the public [GitHub repos of Province of BC](/bcgov). Perhaps it originates from an external dependency, or from a dependency in a private repo.

Solving this bug would prevent confusion and delay for anyone using Firefox while taking the public ISA course.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with ISAPublic/html5/lib/scripts/app.min.js around the prettified lines 40829 and 40843, then reproduce the initial-load failure in Firefox. Trace the minified code to its original source or upstream dependency, since the un-minified implementation is not present in the public repository. Done means the Firefox course page loads without the TypeError and the fix is applied at its source rather than only in the generated bundle.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
frontend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.