bcgov / bcgov/SecurityAwareness
JS bug, presumably in upstream dependency, breaking initial load in SecurityAwareness/PublicISA
- Dominant language
- HTML
- Stars
- 17
- Forks
- 5
- PR merge metrics
- No merged PRs in 30d
Description
A bug in the [Security Awareness course](https://bcgov.github.io/SecurityAwareness/ISAPublic/story_html5.html), linked from the [BC government infosec pro-D page](https://www2.gov.bc.ca/gov/content/governments/services-for-government/information-management-technology/information-security/professional-development/information-security-online-course), initially prevents the course from loading in Firefox. In the minified JS file [app.min.js](/bcgov/SecurityAwareness/blob/master/ISAPublic/html5/lib/scripts/app.min.js), at what becomes line 40829 upon prettifying using the current Firefox Dev Tools, a string is assigned to a variable if the lowercase of the DOM-provided user-agent string contains “firefox”, where a function should be assigned instead. Particularly, where the prettified version of minified code reads:
```js
n = u.isFF() ? 'window.setTimeout' : function (e) {
return e()
};
```
it should instead read:
```js
n = u.isFF() ? window.setTimeout : function (e) {
return e()
};
```
so the value of `n` would become the built-in function `window.setTimeout`, not the string `'window.setTimeout'`.
Uncorrected, this causes the script to fail with a `TypeError` at what becomes line 40843 (as above), when `n` is called as a function, as follows:
```js
n(function () {
i && (f = m(), e())
}, 250)
```
Patching the code as above resolves the bug. (So does spoofing the UA string of any desktop browser besides Firefox.) The bug would of course have to be fixed in the original, un-minified code. To that end, I would’ve forked the repository and filed a PR for this, but the un-minified version of the code in question does not appear to exist anywhere in the public [GitHub repos of Province of BC](/bcgov). Perhaps it originates from an external dependency, or from a dependency in a private repo.
Solving this bug would prevent confusion and delay for anyone using Firefox while taking the public ISA course.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with ISAPublic/html5/lib/scripts/app.min.js around the prettified lines 40829 and 40843, then reproduce the initial-load failure in Firefox. Trace the minified code to its original source or upstream dependency, since the un-minified implementation is not present in the public repository. Done means the Firefox course page loads without the TypeError and the fix is applied at its source rather than only in the generated bundle.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- frontend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100