From 17edb119234e7487b577c3de7c42e3805faf8eb9 Mon Sep 17 00:00:00 2001
From: Ahmed Allam <ahmed39652003@gmail.com>
Date: Sun, 9 Aug 2026 23:44:00 +0000
Subject: [PATCH] fix(container): pin the User-Agent to the installed Chromium
 and assert it at build

---
 containers/Dockerfile           | 11 ++++++++---
 containers/docker-entrypoint.sh |  6 ------
 2 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/containers/Dockerfile b/containers/Dockerfile
index dc6bd8a6..0b05e0ad 100644
--- a/containers/Dockerfile
+++ b/containers/Dockerfile
@@ -116,9 +116,10 @@ RUN npm install -g retire@latest && \
     ln -sf ast-grep /home/pentester/.npm-global/lib/node_modules/@ast-grep/cli/sg
 
 ENV AGENT_BROWSER_EXECUTABLE_PATH=/usr/bin/chromium
-# The User-Agent is derived from the installed Chromium at container start; see
-# containers/docker-entrypoint.sh. AGENT_BROWSER_ARGS is comma-separated, so no
-# flag value may contain a comma (window geometry comes from the display instead).
+# Must match the installed Chromium major; the build asserts it below.
+ENV AGENT_BROWSER_USER_AGENT="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36"
+# AGENT_BROWSER_ARGS is comma-separated, so no flag value may contain a comma
+# (window geometry comes from the virtual display instead).
 ENV AGENT_BROWSER_ARGS="--disable-blink-features=AutomationControlled,--no-first-run,--no-default-browser-check,--lang=en-US,--password-store=basic,--use-mock-keychain,--disable-dev-shm-usage"
 ENV AGENT_BROWSER_SCREENSHOT_DIR=/workspace/.agent-browser-screenshots
 ENV AGENT_BROWSER_IDLE_TIMEOUT_MS=180000
@@ -128,6 +129,10 @@ RUN /home/pentester/.npm-global/bin/agent-browser doctor --offline --quick
 # headed mode here. `--no-sandbox` is build-only: buildkit has no unprivileged
 # user namespaces. The stale X lock/socket must go or the runtime Xvfb refuses.
 RUN set -eu; \
+    chrome_major="$(chromium --version | grep -oE '[0-9]+' | head -1)"; \
+    printf '%s' "${AGENT_BROWSER_USER_AGENT}" | grep -q "Chrome/${chrome_major}\." || { \
+        echo "AGENT_BROWSER_USER_AGENT disagrees with installed Chromium ${chrome_major}"; exit 1; \
+    }; \
     Xvfb :99 -screen 0 1280x800x24 -nolisten tcp >/tmp/xvfb-build.log 2>&1 & \
     xvfb_pid=$!; \
     for _ in $(seq 1 20); do xdpyinfo -display :99 >/dev/null 2>&1 && break; sleep 0.5; done; \
diff --git a/containers/docker-entrypoint.sh b/containers/docker-entrypoint.sh
index 19458530..1885b7d8 100644
--- a/containers/docker-entrypoint.sh
+++ b/containers/docker-entrypoint.sh
@@ -148,14 +148,8 @@ if [ ! -S /run/dbus/system_bus_socket ]; then
   sudo dbus-daemon --system --fork > /tmp/dbus.log 2>&1 || true
 fi
 
-# A UA that disagrees with the installed browser's client hints is a trivially
-# detectable automation signal, so derive it instead of hardcoding a version.
-CHROME_MAJOR="$(chromium --version 2>/dev/null | grep -oE '[0-9]+' | head -1)"
-BROWSER_UA="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${CHROME_MAJOR:-131}.0.0.0 Safari/537.36"
-
 cat << EOF | sudo tee /etc/profile.d/browser.sh
 export DISPLAY=:${DISPLAY_NUM}
-export AGENT_BROWSER_USER_AGENT="${BROWSER_UA}"
 EOF
 
 echo ". /etc/profile.d/browser.sh" >> ~/.bashrc