Merge pull request #1726 from basecamp/flavorjones/better-useragent-behavior

Allow requests from Google Image Proxy

Gemfile

@@ -34,6 +34,7 @@ gem "aws-sdk-s3", require: false
 gem "web-push"
 gem "net-http-persistent"
 gem "mittens"
+gem "useragent", bc: "useragent"
 
 # Telemetry, logging, and operations
 gem "mission_control-jobs"

Gemfile.lock

@@ -16,6 +16,12 @@ GIT
       json
       rails (>= 6.0.0)
 
+GIT
+  remote: https://github.com/basecamp/useragent
+  revision: b253635dc649394c72b761f09234bfd6dc87516a
+  specs:
+    useragent (0.16.11)
+
 GIT
   remote: https://github.com/basecamp/yabeda-activejob.git
   revision: 684973f77ff01d8b3dd75874538fae55961e15e6
@@ -519,7 +525,6 @@ GEM
       unicode-emoji (~> 4.1)
     unicode-emoji (4.1.0)
     uri (1.1.1)
-    useragent (0.16.11)
     vcr (6.3.1)
       base64
     web-console (4.2.1)
@@ -626,6 +631,7 @@ DEPENDENCIES
   thruster
   trilogy (~> 2.9)
   turbo-rails
+  useragent!
   vcr
   web-console
   web-push

test/controllers/allow_browser_test.rb

@@ -0,0 +1,54 @@
+require "test_helper"
+
+class AllowBrowserTest < ActionDispatch::IntegrationTest
+  test "Baidu browser is allowed" do
+    sign_in_as :kevin
+
+    get cards_path, headers: {
+      "User-Agent" => "Mozilla/5.0 (Linux; Android 7.0; HUAWEI NXT-AL10 Build/HUAWEINXT-AL10; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/48.0.2564.116 Mobile Safari/537.36 baidubrowser/7.9.12.0 (Baidu; P1 7.0)NULL"
+    }
+
+    assert_response :success
+  end
+
+  test "nonsense user agent with bot in name is allowed" do
+    sign_in_as :kevin
+
+    get cards_path, headers: {
+      "User-Agent" => "TotallyFakeBot/1.0 (NonsenseBrowser; Testing)"
+    }
+
+    assert_response :success
+  end
+
+  test "nonsense user agent is allowed" do
+    sign_in_as :kevin
+
+    get cards_path, headers: {
+      "User-Agent" => "just some random nonsense text"
+    }
+
+    assert_response :success
+  end
+
+  test "old Chrome browser is rejected with 406" do
+    sign_in_as :kevin
+
+    # Chrome 118 is below the modern threshold of Chrome 120
+    get cards_path, headers: {
+      "User-Agent" => "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118 Safari/537.36"
+    }
+
+    assert_response :not_acceptable
+  end
+
+  test "Google Image Proxy is allowed" do
+    sign_in_as :kevin
+
+    get cards_path, headers: {
+      "User-Agent" => "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko Firefox/11.0 (via ggpht.com GoogleImageProxy)"
+    }
+
+    assert_response :success
+  end
+end