From 0bf62ba4cfedb83267e7eedd8947dd8326d0de6c Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Tue, 25 Nov 2025 16:18:23 -0500
Subject: [PATCH] Update to basecamp's useragent fork

and assert it's working by testing for Baidu
---
 Gemfile                                |  1 +
 Gemfile.lock                           |  8 ++++-
 test/controllers/allow_browser_test.rb | 44 ++++++++++++++++++++++++++
 3 files changed, 52 insertions(+), 1 deletion(-)
 create mode 100644 test/controllers/allow_browser_test.rb

diff --git a/Gemfile b/Gemfile
index 185c0f977..d008f4907 100644
--- a/Gemfile
+++ b/Gemfile
@@ -34,6 +34,7 @@ gem "aws-sdk-s3", require: false
 gem "web-push"
 gem "net-http-persistent"
 gem "mittens"
+gem "useragent", bc: "useragent"
 
 # Telemetry, logging, and operations
 gem "mission_control-jobs"
diff --git a/Gemfile.lock b/Gemfile.lock
index 4ad05f969..de664bea5 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -16,6 +16,12 @@ GIT
       json
       rails (>= 6.0.0)
 
+GIT
+  remote: https://github.com/basecamp/useragent
+  revision: 746e37ba93cef6399920d18ad88903db92ba4e30
+  specs:
+    useragent (0.16.10)
+
 GIT
   remote: https://github.com/basecamp/yabeda-activejob.git
   revision: 684973f77ff01d8b3dd75874538fae55961e15e6
@@ -519,7 +525,6 @@ GEM
       unicode-emoji (~> 4.1)
     unicode-emoji (4.1.0)
     uri (1.1.1)
-    useragent (0.16.11)
     vcr (6.3.1)
       base64
     web-console (4.2.1)
@@ -626,6 +631,7 @@ DEPENDENCIES
   thruster
   trilogy (~> 2.9)
   turbo-rails
+  useragent!
   vcr
   web-console
   web-push
diff --git a/test/controllers/allow_browser_test.rb b/test/controllers/allow_browser_test.rb
new file mode 100644
index 000000000..470087d51
--- /dev/null
+++ b/test/controllers/allow_browser_test.rb
@@ -0,0 +1,44 @@
+require "test_helper"
+
+class AllowBrowserTest < ActionDispatch::IntegrationTest
+  test "Baidu browser is allowed" do
+    sign_in_as :kevin
+
+    get cards_path, headers: {
+      "User-Agent" => "Mozilla/5.0 (Linux; Android 7.0; HUAWEI NXT-AL10 Build/HUAWEINXT-AL10; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/48.0.2564.116 Mobile Safari/537.36 baidubrowser/7.9.12.0 (Baidu; P1 7.0)NULL"
+    }
+
+    assert_response :success
+  end
+
+  test "nonsense user agent with bot in name is allowed" do
+    sign_in_as :kevin
+
+    get cards_path, headers: {
+      "User-Agent" => "TotallyFakeBot/1.0 (NonsenseBrowser; Testing)"
+    }
+
+    assert_response :success
+  end
+
+  test "nonsense user agent is allowed" do
+    sign_in_as :kevin
+
+    get cards_path, headers: {
+      "User-Agent" => "just some random nonsense text"
+    }
+
+    assert_response :success
+  end
+
+  test "old Chrome browser is rejected with 406" do
+    sign_in_as :kevin
+
+    # Chrome 118 is below the modern threshold of Chrome 120
+    get cards_path, headers: {
+      "User-Agent" => "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118 Safari/537.36"
+    }
+
+    assert_response :not_acceptable
+  end
+end