How do I detect if Edge Browser input corruption bug has been patched

user_6338639 0
Viewed 97

Recently Edge browser had a bug with <option> elements with the value attribute omitted. 

<select name="qty">
  <option>1</option>
  <option>2</option>
</select>

Affected Edge browsers inject random characters into the form data: qty=1Q or qty=2Җ or worse qty=29

Microsoft pushed a fix in July their issue #1747791 in the July RS4 Windows 10 Update, kb4338819. With this fix, they did not increment the browser version number, 17.17134. They instead incremented the Operating System Build number to 17134.165

An application I support continues to receive bug reports from users with old versions of Edge. I would like to detect a user with the affected browser and display a warning.

The broken and fixed versions of Edge both report the same version number in the UserAgent string, 17.17134. Is there another way to detect the build of Edge, or the OS Build number?

How do I detect if this Edge Browser input corruption bug has been patched?

microsoft-edge browser-detection javascript
3 Answers

First thing I would do is audit missing value on <option> using javascript if that is the root of the problem as seems to be mentioned in link you posted.

Then , if you have no way to sniff the differences in user agent one way to test would be to programmatically (javascript) submit an off-screen form into an off screen or hidden iFrame target when that user agent is encountered.

This would be done on page load with no user interaction

Then validate server side and return a page to the iframe with a postMessage() call that would tell parent page if problem exists or not.

Will require postMessage event listener in parent also.

Both the form and iframe could be inserted into dom using script on as needed basis

user_11759660

Adapted solution from @charlietfl

A hidden iframe is presented only when the user has the affected useragent. Today, this includes up to date Edge browsers, but in October the version in the UserAgent should increment again.

Rather than interact back to the parent window, the iframe opens to a page that can access the user session. It presents a HTML form of the type affected by the bug, and immediately posts itself. The POST data is checked for corruption, and results made available to the user session.

The rather obvious javascript (with jquery) looks a bit like this:

  % if ( $do_check ) {
    <iframe id="edge_browser_check_iframe" style="display:none;"></iframe>
    <script type="text/javascript">
      if ( /Edge\/17\.17134/.test( navigator.userAgent )) {
        $("#edge_browser_check_iframe").attr(
          'src',
          'edge_browser_check-iframe.html'
        );
      }
    </script>
  % }
user_63386390

A work around can be create JavaScript function to detect the Edge browser and it's version while user opens the site.

If it is a problematic version then inform user to use other browser and do not allow any further interaction.

If it is any other version of Edge then let the user to use the site.

Regards

Deepak

user_103093810
Related