NumberFormatException: For input string: "534+ (khtml, like gecko) bingpreview/1.0"

[thomaskiesl]

Description of the bug

Same/similar issue as #20784

Expected behavior

Error in the logfile:

2025-01-13 07:56:15,705 ERROR | http-nio-18443-exec-27 | com.vaadin.flow.shared.BrowserDetails | Browser engine version parsing failed for: mozilla/5.0 (windows nt 6.1; wow64) applewebkit/534+ (khtml, like gecko) bingpreview/1.0b java.lang.NumberFormatException: For input string: "534+ (khtml, like gecko) bingpreview/1.0" at java.base/jdk.internal.math.FloatingDecimal.readJavaFormatString(FloatingDecimal.java:2054) at java.base/jdk.internal.math.FloatingDecimal.parseFloat(FloatingDecimal.java:122) at java.base/java.lang.Float.parseFloat(Float.java:476) at com.vaadin.flow.shared.BrowserDetails.<init>(BrowserDetails.java:124) at com.vaadin.flow.server.WebBrowser$1.<init>(WebBrowser.java:70) at com.vaadin.flow.server.WebBrowser.<init>(WebBrowser.java:70) at com.vaadin.flow.server.VaadinService.createAndRegisterSession(VaadinService.java:1015) at com.vaadin.flow.server.VaadinService.doFindOrCreateVaadinSession(VaadinService.java:979) at com.vaadin.flow.server.VaadinService.findOrCreateVaadinSession(VaadinService.java:921) at com.vaadin.flow.server.VaadinService.findVaadinSession(VaadinService.java:760) at com.vaadin.flow.server.VaadinService.handleRequest(VaadinService.java:1658) at com.vaadin.flow.server.VaadinServlet.service(VaadinServlet.java:398) at com.vaadin.flow.spring.SpringServlet.service(SpringServlet.java:106) at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:658) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:195) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140) at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:51) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140) at org.springframework.web.filter.CompositeFilter$VirtualFilterChain.doFilter(CompositeFilter.java:108) at org.springframework.security.web.FilterChainProxy.lambda$doFilterInternal$3(FilterChainProxy.java:231) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:365) at org.springframework.security.web.access.intercept.AuthorizationFilter.doFilter(AuthorizationFilter.java:101) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:126) at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:120) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:100) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) at

Minimal reproducible example

Since Vaadin 24.6.0

Versions

• Vaadin / Flow version: 24.6.1
• Java version: 17
• OS version: CentOS

[caalador]

Seems it's from BingPreview for Windows 8 app? As the latest agent they give is a little different

from Bing crawlers
BingPreview generates page snapshots for Bing. You can find more details about BingPreview here. Note that BingPreview has "desktop" and "mobile" variants.

Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/W.X.Y.Z Safari/537.36
	
Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/W.X.Y.Z Mobile Safari/537.36  (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)

[knoobie]

OT: Now that Browser "parsing" is not really needed anymore to determine usability of flow.. I'm wondering if the log message should be lowered to e.g. INFO without an exception.. it isn't really harmful and can create a lot of noise.

[thomaskiesl]

Ich habe nochmal eine ähnliche Fehlermeldung erhalten:

2025-01-15 19:53:16,941 ERROR | http-nio-18443-exec-43 | com.vaadin.flow.shared.BrowserDetails                   | Browser minor version parsing failed for:
With userAgent: mozilla/5.0 (windows nt 10.0; win64; x64; rv:121.0) gecko/20100101 firefox/121.
java.lang.NumberFormatException: For input string: ""
    at java.base/java.lang.NumberFormatException.forInputString(NumberFormatException.java:67)
    at java.base/java.lang.Integer.parseInt(Integer.java:678)
    at java.base/java.lang.Integer.parseInt(Integer.java:786)
    at com.vaadin.flow.shared.BrowserDetails.parseVersionPart(BrowserDetails.java:464)
    at com.vaadin.flow.shared.BrowserDetails.parseVersionString(BrowserDetails.java:440)
    at com.vaadin.flow.shared.BrowserDetails.<init>(BrowserDetails.java:177)
    at com.vaadin.flow.server.WebBrowser$1.<init>(WebBrowser.java:70)
    at com.vaadin.flow.server.WebBrowser.<init>(WebBrowser.java:70)
    at com.vaadin.flow.server.VaadinService.createAndRegisterSession(VaadinService.java:1015)
    at com.vaadin.flow.server.VaadinService.doFindOrCreateVaadinSession(VaadinService.java:979)
    at com.vaadin.flow.server.VaadinService.findOrCreateVaadinSession(VaadinService.java:921)
    at com.vaadin.flow.server.VaadinService.findVaadinSession(VaadinService.java:760)
    at com.vaadin.flow.server.VaadinService.handleRequest(VaadinService.java:1658)
    at com.vaadin.flow.server.VaadinServlet.service(VaadinServlet.java:398)
    at com.vaadin.flow.spring.SpringServlet.service(SpringServlet.java:106)
    at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:658)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:195)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140)
    at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:51)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140)
    at org.springframework.web.filter.CompositeFilter$VirtualFilterChain.doFilter(CompositeFilter.java:108)
    at org.springframework.security.web.FilterChainProxy.lambda$doFilterInternal$3(FilterChainProxy.java:231)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:365)
    at org.springframework.security.web.access.intercept.AuthorizationFilter.doFilter(AuthorizationFilter.java:101)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374)
    at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:126)
    at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:120)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374)
    at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:100)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374)
    at

[caalador]

We should perhaps rethink what we should log for these. As a failing version parse only makes the value be -1 and it doesn't throw or block in any way.
The update to use logger instead of system out only makes it ofc more visible, but now it's probably too visible. Perhaps just skipping the stack trace would be enough as then the output would just be:

Browser minor version parsing failed for: ""
With userAgent: mozilla/5.0 (windows nt 10.0; win64; x64; rv:121.0) gecko/20100101 firefox/121.

[knoobie]

I would personally also lower the severity to INFO or lower - often WARN and above are send to security or ops teams automatically.. people that are really allergic to erros.. even tho you could also argue: but what if.. somebody uses the browser header to send malformed content.. wouldn't it be good that it's still reported to the security guys? Double edged sword..