RR-540: Replace apparition with selenium-webdriver

[dduugg]

Note that #92 also contains this work, though implemented differently.

(I'm not tied to this implementation, but i do think we want to break up that PR.)

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

• gem/nokogiri@1.15.7

View full report

[dduugg]

@SocketSecurity ignore gem/nokogiri@1.15.7
This is a pre-existing Gemfile.lock dependency

[dryrunsecurity]

This pull request disables Chrome's sandbox in Capybara tests by adding the '--no-sandbox' flag (running in a root Docker container increases risk of host compromise if the browser is exploited) and adds nokogiri 1.15.7 which is vulnerable to a critical CVE (fixed in >= 1.18.9).

Disabled Browser Sandbox in spec/spec_helper.rb

Vulnerability

Disabled Browser Sandbox

Description

The Chrome driver for Capybara tests is configured with the '--no-sandbox' argument. This disables a critical security feature that provides process isolation for the browser. Since the Docker container runs as the root user (due to the absence of a 'USER' instruction in the Dockerfile), an attacker exploiting a browser vulnerability during a test run could potentially execute code on the host machine with root privileges, leading to a severe compromise.

grpc-web-ruby/spec/spec_helper.rb

Lines 119 to 122 in af65d87

	options.add_argument('--no-sandbox')
	# Prevent Chrome from using /dev/shm which can be too small in Docker, causing crashes
	options.add_argument('--disable-dev-shm-usage')
	# Disable GPU hardware acceleration to prevent crashes in headless mode

Vulnerable Dependency in Gemfile.lock

Vulnerability	Vulnerable Dependency
Description	The nokogiri gem version 1.15.7, which is added as a dependency, has a critical vulnerability (GHSA-353f-x4gh-cqq8). This vulnerability stems from nokogiri patching its vendored libxml2 library to resolve multiple CVEs. The affected versions include 1.15.7, and the issue is fixed in version 1.18.9.

grpc-web-ruby/Gemfile.lock

Lines 102 to 112 in af65d87

	rubocop-rspec (1.41.0)
	rubocop (>= 0.68.1)
	ruby-progressbar (1.13.0)
	rubyzip (2.4.1)
	selenium-webdriver (4.9.0)
	rexml (~> 3.2, >= 3.2.5)
	rubyzip (>= 1.2.2, < 3.0)
	websocket (~> 1.0)
	simplecov (0.22.0)
	docile (~> 1.1)
	simplecov-html (~> 0.11)

---

All finding details can be found in the DryRun Security Dashboard.

[joemsak]

Nice!