orca/src
Wooseong Kim 84e7ca5212
fix(browser): reject Chromium product versions in cookie-import UA (#12811)
* fix(browser): reject Chromium product versions in cookie-import UA

Do not persist Chrome/1.x User-Agents when a fork (e.g. Arc) reports its
product CFBundleShortVersionString. Only engine-scale majors (>=70) are
advertised; otherwise fall back to Electron's default UA.

Preserves Chrome-shaped UAs for real Chromium engine versions.

Fixes #12726

* fix(browser): reject malformed Chromium version tokens in UA

Validate every numeric component before advertising Chrome/… so values
like 70.not-a-version fall back instead of polluting the UA. Also build
macOS app paths with path.join per coding guidelines.

* fix(browser): drop already-persisted Chrome/1.x UAs on session restore

The version gate stops new fork imports from writing Chrome/1.x, but profiles imported before it keep the broken UA in browser-session-meta.json and replay it on every launch, so affected users stay blocked with no in-app recovery.

Move the gate into browser-session-ua (the module that owns UA shape, and the one both callers can import without a cycle) and drop an unadvertisable persisted UA during restore so the profile falls back to Orca's own engine UA.

---------

Co-authored-by: Jinwoo-H <Jinwoo-H@users.noreply.github.com>
2026-08-08 02:22:25 -07:00
..
cli Add account-backed artifact sharing (#13012) 2026-08-07 23:02:29 -07:00
main fix(browser): reject Chromium product versions in cookie-import UA (#12811) 2026-08-08 02:22:25 -07:00
preload fix(mobile): allow reachable Hyper-V pairing addresses (#13107) 2026-08-07 20:37:47 -07:00
relay Add account-backed artifact sharing (#13012) 2026-08-07 23:02:29 -07:00
renderer Add account-backed artifact sharing (#13012) 2026-08-07 23:02:29 -07:00
shared Add account-backed artifact sharing (#13012) 2026-08-07 23:02:29 -07:00
types fix(codex): publish Windows system-default sessions (#12611) 2026-08-07 16:53:41 -07:00