Skip to content

UnreachableBrowserException logs the command parameter details only in debug mode#11328

Merged
diemol merged 3 commits intoSeleniumHQ:trunkfrom
debanjanc01:feature-11275-exception-details-leak
Jul 24, 2023
Merged

UnreachableBrowserException logs the command parameter details only in debug mode#11328
diemol merged 3 commits intoSeleniumHQ:trunkfrom
debanjanc01:feature-11275-exception-details-leak

Conversation

@debanjanc01
Copy link
Copy Markdown
Contributor

@debanjanc01 debanjanc01 commented Nov 28, 2022

Description

This resolves: #11275
In the case when UnreachableBrowserException is raised, only the command parameter names will be logged (unless in debug mode) so as to not reveal any sensitive information.

In order to test the changes, org.mockito:mockito-inline has been added as a dependency.

Motivation and Context

This solves: #11275

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)

Checklist

  • I have read the contributing document.
  • My change requires a change to the documentation.
  • I have updated the documentation accordingly.
  • I have added tests to cover my changes.
  • All new and existing tests passed.

@debanjanc01 debanjanc01 force-pushed the feature-11275-exception-details-leak branch 2 times, most recently from d053fef to d1c1c29 Compare November 28, 2022 14:37
@titusfortner titusfortner added the C-java Java Bindings label Nov 28, 2022
@titusfortner
Copy link
Copy Markdown
Member

titusfortner commented Jul 21, 2023

@debanjanc01 sorry we did not review this in a timely manner, but it needs to be rebased with trunk. Can you update it?

@titusfortner titusfortner requested a review from joerg1985 July 21, 2023 12:25
@debanjanc01
Copy link
Copy Markdown
Contributor Author

debanjanc01 commented Jul 21, 2023

@debanjanc01 sorry we did not review this in a timely manner, but it needs to be rebased with trunk. Can you update it?

Hey @titusfortner sure I'll rebase and update the PR.

@debanjanc01 debanjanc01 force-pushed the feature-11275-exception-details-leak branch 3 times, most recently from 3cc72b0 to f74bc8c Compare July 21, 2023 16:15
@debanjanc01 debanjanc01 force-pushed the feature-11275-exception-details-leak branch from f74bc8c to 3828661 Compare July 21, 2023 16:17
@debanjanc01
Copy link
Copy Markdown
Contributor Author

debanjanc01 commented Jul 21, 2023

@titusfortner I've rebased with trunk

@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented Jul 21, 2023

Codecov Report

Patch coverage has no change and project coverage change: -0.01 ⚠️

Comparison is base (0013140) 56.97% compared to head (f6044b0) 56.97%.

❗ Current head f6044b0 differs from pull request most recent head 3828661. Consider uploading reports for the commit 3828661 to get more accurate results

❗ Your organization is not using the GitHub App Integration. As a result you may experience degraded service beginning May 15th. Please install the Github App Integration for your organization. Read more.

Additional details and impacted files 
@@            Coverage Diff             @@
##            trunk   #11328      +/-   ##
==========================================
- Coverage   56.97%   56.97%   -0.01%     
==========================================
  Files          86       86              
  Lines        5337     5336       -1     
  Branches      193      193              
==========================================
- Hits         3041     3040       -1     
  Misses       2103     2103              
  Partials      193      193
Impacted Files Coverage Δ
py/selenium/webdriver/common/selenium_manager.py 62.90% <ø> (-0.59%) ⬇️

☔ View full report in Codecov by Sentry.
📢 Do you have feedback about the report comment? Let us know in this issue.

diemol
diemol approved these changes Jul 24, 2023
View reviewed changes
Copy link
Copy Markdown
Member

@diemol diemol left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you, @debanjanc01!
I made some adjustments, but most of the work was already there.

@diemol diemol merged commit 9ff4c2b into SeleniumHQ:trunk Jul 24, 2023
@joerg1985
Copy link
Copy Markdown
Member

joerg1985 commented Jul 24, 2023

@diemol i am to late with my review, but one question, why is there a toThrow instanceof UnreachableBrowserException && !Debug.isDebugging() condition and not only a !Debug.isDebugging() condition?

My original issue described it in the case of a UnreachableBrowserException but are there no other cases where we could leak infos e.g. by a NoSuchSessionException?

@diemol
Copy link
Copy Markdown
Member

diemol commented Jul 24, 2023

I did not spend time analyzing the whole range of possibilities. If there is more, let's specify it here, and reopen so we can iterate.

@debanjanc01
Copy link
Copy Markdown
Contributor Author

debanjanc01 commented Jul 26, 2023

@joerg1985 I did think of the possibilities of other Exception cases having the same bug. But since the original issue mentioned UnreachableBrowserException specifically I've added the explicit instanceof check.
I agree with @diemol , we could iterate on this to cover the whole range of possibilities.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@diemol diemol diemol approved these changes

@joerg1985 joerg1985 Awaiting requested review from joerg1985

Assignees

No one assigned

Labels

C-java Java Bindings

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[🚀 Feature]: let the UnreachableBrowserException not leak details of the command

5 participants

@debanjanc01 @titusfortner @codecov-commenter @joerg1985 @diemol