Not all coders are created equal. But there should be a line where we collectively just say, “Please stop”.
Would like to say found two critical issues in two Python packages, but it’s obvious to a six year old. Not sure can claim credit for such in your face obvious issues.
And since it’s so obvious, responsible disclosure kinda got kicked to the curb.
These libraries pin the required dependencies and test only one python interpreter, so lets just say had lowered expectations going in.
get-gecko-driver and get-chrome-driver look like they are unneeded since both selenium and webdriver-manager can download selenium webdrivers. In the later two packages, web browser support is sparse; there is room for more flexibility. For example, support for waterfox, librewolf, and mullvad-browser.
Issues summary:
-
downloader module can send a GET request to any URL. There is no URL whitelist. These packages can be used for cover when making arbitrary GET requests.
-
downloader can save anywhere on the file system. So can be used for other purposes besides downloading selenium webdriver.
-
no permission checks before saving/writing the file.
-
get_gecko_driver.downloader and get_chrome_driver.downloader are the exact same module.
I lack confidence the author will respond, will be very pleasantly surprised if the author fix these issues in a timely manner. Nor confidence he’d do a good job. But at least these issues are disclosed and the ball is in his court.
For your entertainment:
All these coding errors are unforgivable and obvious to even a novice coder, a laymen, or a random drunk. It takes talent not to see it. If bothered to do unit testing, would be unavoidable to not see it.
These issues are both CRITICAL SECURITY issues.
Obvious is obvious, don’t kill the messenger, instead lets just fix this issue. The correct action is to quickly fix it and then just agree never to mention it again and pray there is no Darwin award for coders.
Also way to go not taking the side of:
an active member of this community
someone understanding and in a position to increase browser support for selenium webdrivers
a coder who’d care and doesn’t suck at coding
So what do you get for the Captain Obvious comment besides being right? A clock is right twice a day. But no dopamine hit from a clock.
A better strategy, would be to ask about how to go about increasing selenium web driver browser support and whether a more flexible package is in the works. Not to defend a hopeless package in dire need of a rewrite. Or to provide the info i ask for about how to go about responsibly disclosing security issues.
Understand your heart is in the right place. Hope you can understand that alone isn’t the only consideration or way to look at this. You can press the issue and still come away with nothing.
rinse wash repeat and still the reflex reaction will remain the same. I’m suggesting trying something else.
Okay I think it’s worth responding to these point by point:
I’m not taking sides. Being an active member of a community doesn’t absolve you or anyone else of behaving irresponsibly.
I don’t doubt your intention to increase browser support for selenium webdrivers. However I don’t agree with your decision to disclose what you deem a critical security bug without any indication that you attempted to disclose the issue to the project maintainer before advertising the issue here.
Your coding ability in this situation is not in question or an issue.
What I got were clarifications to questions I had after reading your original post. I wanted to make sure that I hadn’t made any quick assumptions before I concluded whether or not I thought you had behaved ethically.
Your original post didn’t ask how to responsibly disclose a security issue. And you posted this, by your own admission, without responsibly disclosing.
For future reference, here is how you responsibly disclose critical security issues to a project: you find contact information for a maintainer or, if available, the project’s security team. You send them a message confidentially (email, private message, issue tracker post stating you have found a critical issue you wish to disclose securely). You wait for them to get back to you. If they do, you coordinate a fix, and then you wait for the fix to be released and communicated before releasing details of the issue.
If the maintainer doesn’t get back to you, try another maintainer. If they don’t get back to you, then you’ve done all you can and you can release information on the issue.
Let me ask you: what was your intention behind your original post? You haven’t provided a fix here, or a PR, as far as I can see you haven’t forked the project with a fix. So I don’t understand how doing this makes the situation any better, if anything it’s placed the users of this project at a higher risk.
These packages are selenium webdriver flavored curl.
Did not set out to be a security researcher chasing bug bounties. Was not looking to discover exploits. It just happened. Read enough packages and eventually by random chance it’s bound to happen.
After submitting an issue (admittedly in the open), have not submitted PR to fix the attack packages. Even if wanted to, PRs happen AFTER an issue is approved by the author/maintainer.
Have posted 4 issues without any response. The 5th magically disappeared. There has been no comments from the author.
Appealing to the author might not be the correct tactic. Just wondering if these are the sort of packages pypi.org takes down.
Working on a bigger project which is on my local machine. Got to the point wanted to maximize the selenium webdrivers supported browsers. Currently writing the selenium webdriver related unit tests. Have no issue with branching off the parts dealing with selenium webdrivers and publishing that. It’s just not at that stage. And will probably refactor it again to conform to webdriver-manager standards.
While doing the testing, and while fixing the geckodriver chained downloader, went thru multiple stages of denial until realized these packages main focus is the downloader, and the installing selenium web drivers is merely window dressing.
The fixes are trivial: