UserAgentAnalyzer.parse() throw ArrayIndexOutOfBoundsException

[benjben]

We've seen UserAgentAnalyzer.parse() throw an ArrayIndexOutOfBoundsException :

java.lang.ArrayIndexOutOfBoundsException: Index 1 out of bounds for length 1
    at nl.basjes.parse.useragent.clienthints.ClientHintsAnalyzer.improveLayoutEngineAndAgentInfo(ClientHintsAnalyzer.java:325)
    at nl.basjes.parse.useragent.clienthints.ClientHintsAnalyzer.merge(ClientHintsAnalyzer.java:151)
    at nl.basjes.parse.useragent.AbstractUserAgentAnalyzerDirect.parse(AbstractUserAgentAnalyzerDirect.java:212)
    at nl.basjes.parse.useragent.AbstractUserAgentAnalyzer.lambda$parse$0(AbstractUserAgentAnalyzer.java:234)
    at com.github.benmanes.caffeine.cache.BoundedLocalCache.lambda$doComputeIfAbsent$13(BoundedLocalCache.java:2550)
    at java.util.concurrent.ConcurrentHashMap.compute(ConcurrentHashMap.java:1908)
    at com.github.benmanes.caffeine.cache.BoundedLocalCache.doComputeIfAbsent(BoundedLocalCache.java:2548)
    at com.github.benmanes.caffeine.cache.BoundedLocalCache.computeIfAbsent(BoundedLocalCache.java:2531)
    at com.github.benmanes.caffeine.cache.LocalCache.computeIfAbsent(LocalCache.java:110)
    at nl.basjes.parse.useragent.AbstractUserAgentAnalyzer.parse(AbstractUserAgentAnalyzer.java:234)
    at nl.basjes.parse.useragent.AbstractUserAgentAnalyzerDirect.parse(AbstractUserAgentAnalyzerDirect.java:188)
    at com.snowplowanalytics.snowplow.enrich.common.enrichments.registry.YauaaEnrichment.analyzeUserAgent(YauaaEnrichment.scala:113)

Unfortunately we don't have the user agent for which it happens.

[nielsbasjes]

What version did this?

[benjben]

Oh sorry for not mentioning it ! 7.7.0

[nielsbasjes]

This is a bug in 7.7.0.
It happens when there is a Sec-Ch-Ua-Full-Version-List with a Chromium version that is only a major version.
For example:

'"Google Chrome";v="105", "Not)A;Brand";v="8.0.0.0", "Chromium";v="105"'

[nielsbasjes]

This specific problem does not occur anymore in v7.9.0

[benjben]

Great, thank you!

[nielsbasjes]

FYI:
GHSA-c4pm-63cg-9j7h

[nielsbasjes]

CVE-2022-23496