Answers.Body: <p>What I believe it's flagging based on the "description" line in your post is probably that the UserAgent tool could be used by bad people to get information about a browser, possibly to look for versions or configurations with known security holes to exploit. But it doesn't seem to be used in CiviCRM as far as I can see, and the APC.php subclass file all it does is store the results in the APC cache if you're using that. I wonder if the whole Net/UserAgent folder could be removed from Civi.</p>
  
  <p>UPDATE: It looks like the file will be removed in civi version 5.22: <a href="https://github.com/civicrm/civicrm-packages/pull/272" rel="nofollow noreferrer">https://github.com/civicrm/civicrm-packages/pull/272</a></p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-12-14T18:54:19.433Z
Answers.Text: Same issue.  Also looking for a definitive answer.  I've posted a question on CiviCRM Chat / Town Square.  Nothing definitive there yet.
Answers.UserDisplayName: dvhirst
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-12-14T18:58:50.550Z
Answers.Text: I can definitely say it is not a virus. As noted in the answer all the file does is store the results of UserAgent Detect in the APC cache. But you're right as to why wordfence is flagging it, no I don't have a definitive answer to that.
Answers.UserDisplayName: Demerit
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-12-14T19:01:54.913Z
Answers.Text: I believe I can safely tell WordFence to ignore the file.  I'll do that, and keep an eye out here and on CiviCRM Chat.  Thanks.
Answers.UserDisplayName: dvhirst
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-12-16T06:19:05.600Z
Answers.Text: [history for that code](https://github.com/civicrm/civicrm-packages/commits/master/Net/UserAgent) says it hasn't been touched in years, [search for usage in packages](https://github.com/civicrm/civicrm-packages/commits/master/Net/UserAgent) shows no usage, and [search for use in core](https://github.com/civicrm/civicrm-core/search?utf8=%E2%9C%93&q=net_useragent&type=) indicates no use in core.  burn it!
Answers.UserDisplayName: Chris Burgess
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-12-16T06:37:50.073Z
Answers.Text: @chris-burgess Seamus has put up a PR to remove it. Can you comment there too? https://github.com/civicrm/civicrm-packages/pull/272
Answers.UserDisplayName: Demerit
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-06-02T05:52:37.927Z
Answers.Text: This just popped up again.  Did the module get restored somehow? I checked, and the folder/file is definitely there in CiviCRM 5.20.0.
Answers.UserDisplayName: dvhirst
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-06-02T06:12:19.903Z
Answers.Text: Hi, as noted in the answer it was removed in 5.22. So 5.20 still has it but you can remove it manually.
Answers.UserDisplayName: Demerit
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-12-12T18:46:59.517Z
Answers.LastActivityDate: 2019-12-17T03:52:42.583Z
Answers.LastEditDate: 2019-12-17T03:52:42.583Z
Answers.UserDisplayName: Demerit
Body: <p>Our Wordpress firewall Wordfence has flagged packages/Net/UserAgent/Detect/APC.php as possibly a malicious file.  Based on past experience, I assume this is a false positive.  However, I posted it here in case it is a real problem.</p>
  
  <p><strong>Filename:</strong> wp-content/civicrm 5.18.3/civicrm/packages/Net/UserAgent/Detect/APC.php</p>
  
  <p><strong>File Type:</strong> Not a core, theme, or plugin file from wordpress.org.</p>
  
  <p><strong>Details:</strong> This file appears to be installed or modified by a hacker to perform malicious activity. If you know about this file you can choose to ignore it to exclude it from future scans. The matched text in this file is: 
  
  <p>The issue type is: <strong>Suspicious:PHP/antibotInclude.C.7882</strong></p>
  
  <p>Description: <strong>Inclusion of an antibot file, often used in phishing kits</strong></p>
  
Tags: <wordpress><php><security>
Title: packages/Net/UserAgent/Detect/APC.php flagged as malicious by Wordfence Firewall
ThreadText: # packages/Net/UserAgent/Detect/APC.php flagged as malicious by Wordfence Firewall
  
  (Asked by: username_0 on 2019-12-12)
  
  Our Wordpress firewall Wordfence has flagged packages/Net/UserAgent/Detect/APC.php as possibly a malicious file. Based on past experience, I assume this is a false positive. However, I posted it here in case it is a real problem.
  
  **Filename:** wp-content/civicrm 5.18.3/civicrm/packages/Net/UserAgent/Detect/APC.php
  
  **File Type:** Not a core, theme, or plugin file from wordpress.org.
  
  **Details:** This file appears to be installed or modified by a hacker to perform malicious activity. If you know about this file you can choose to ignore it to exclude it from future scans. The matched text in this file is:
  
  The issue type is: **Suspicious:PHP/antibotInclude.C.7882**
  
  Description: **Inclusion of an antibot file, often used in phishing kits**
  
  **Tags:** wordpress, php, security
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2019-12-12. Score: 1
  
  What I believe it's flagging based on the "description" line in your post is probably that the UserAgent tool could be used by bad people to get information about a browser, possibly to look for versions or configurations with known security holes to exploit. But it doesn't seem to be used in CiviCRM as far as I can see, and the APC.php subclass file all it does is store the results in the APC cache if you're using that. I wonder if the whole Net/UserAgent folder could be removed from Civi.
  
  UPDATE: It looks like the file will be removed in civi version 5.22: <https://github.com/civicrm/civicrm-packages/pull/272>
  
  > **Comments:**
  > **username_2**: Same issue.  Also looking for a definitive answer.  I've posted a question on CiviCRM Chat / Town Square.  Nothing definitive there yet.  
  > **username_1**: I can definitely say it is not a virus. As noted in the answer all the file does is store the results of UserAgent Detect in the APC cache. But you're right as to why wordfence is flagging it, no I don't have a definitive answer to that.  
  > **username_2**: I believe I can safely tell WordFence to ignore the file.  I'll do that, and keep an eye out here and on CiviCRM Chat.  Thanks.  
  > **username_3**: [history for that code](https://github.com/civicrm/civicrm-packages/commits/master/Net/UserAgent) says it hasn't been touched in years, [search for usage in packages](https://github.com/civicrm/civicrm-packages/commits/master/Net/UserAgent) shows no usage, and [search for use in core](https://github.com/civicrm/civicrm-core/search?utf8=%E2%9C%93&q=net_useragent&type=) indicates no use in core.  burn it!  
  > **username_1**: @chris-burgess Seamus has put up a PR to remove it. Can you comment there too? https://github.com/civicrm/civicrm-packages/pull/272  
  > **username_2**: This just popped up again.  Did the module get restored somehow? I checked, and the folder/file is definitely there in CiviCRM 5.20.0.  
  > **username_1**: Hi, as noted in the answer it was removed in 5.22. So 5.20 still has it but you can remove it manually.  
  
  ---
  
  