fix(security): address multiple security vulnerabilities across codebase (#14570)

christian-bromann · github-advanced-security[bot] · web-flow · commit 37b453658065 · 2025-07-16T11:18:01.000-07:00
* fix(security): address multiple security vulnerabilities across codebase

* further improvements

* fix unit tests

* Potential fix for code scanning alert no. 65: Incomplete multi-character sanitization

Co-authored-by: Copilot Autofix powered by AI &lt;62310815+github-advanced-security[bot]@users.noreply.github.com&gt;

* Potential fix for code scanning alert no. 69: Incomplete multi-character sanitization

Co-authored-by: Copilot Autofix powered by AI &lt;62310815+github-advanced-security[bot]@users.noreply.github.com&gt;

* properly escape regexp

* minor formatting

* improvements

* Potential fix for code scanning alert no. 72: Bad HTML filtering regexp

Co-authored-by: Copilot Autofix powered by AI &lt;62310815+github-advanced-security[bot]@users.noreply.github.com&gt;

* Potential fix for code scanning alert no. 76: Incomplete multi-character sanitization

Co-authored-by: Copilot Autofix powered by AI &lt;62310815+github-advanced-security[bot]@users.noreply.github.com&gt;

* more stable comment removal implementation

* fix tests

---------

Co-authored-by: Copilot Autofix powered by AI &lt;62310815+github-advanced-security[bot]@users.noreply.github.com&gt;
diff --git a/infra/compiler/src/plugins.ts b/infra/compiler/src/plugins.ts
@@ -1,7 +1,6 @@
 import cp, { type ExecException } from 'node:child_process'
 import url from 'node:url'
 import path from 'node:path'
-import util from 'node:util'
 import chalk from 'chalk'
 import { rimraf } from 'rimraf'
 import { copy } from 'esbuild-plugin-copy'
@@ -10,7 +9,6 @@ import type { PackageJson } from 'type-fest'
 
 const MAX_RETRIES = 3
 const __dirname = path.dirname(url.fileURLToPath(import.meta.url))
-const exec = util.promisify(cp.exec)
 const tscPath = path.resolve(path.dirname(url.fileURLToPath(import.meta.resolve('typescript'))), '..', 'bin', 'tsc')
 
 const l = {
@@ -74,8 +72,36 @@ export function clear(config: BuildOptions): Plugin {
  * @return {Promise<void>} A promise that resolves when the types are generated.
  */
 function generateTypes(cwd: string, pkg: PackageJson, retry = MAX_RETRIES): Promise<void> {
-    const child = exec(`node ${tscPath} --emitDeclarationOnly`, { cwd })
-    return child.then(() => { }, (err) => {
+    return new Promise<void>((resolve, reject) => {
+        const child = cp.spawn('node', [tscPath, '--emitDeclarationOnly'], { cwd })
+        let stdout = ''
+        let stderr = ''
+
+        child.stdout?.on('data', (data) => {
+            stdout += data
+        })
+
+        child.stderr?.on('data', (data) => {
+            stderr += data
+        })
+
+        child.on('close', (code) => {
+            if (code === 0) {
+                resolve(undefined)
+            } else {
+                const error = new Error(`TypeScript compilation failed with code ${code}`)
+                // @ts-ignore
+                error.stdout = stdout
+                // @ts-ignore
+                error.stderr = stderr
+                reject(error)
+            }
+        })
+
+        child.on('error', (error) => {
+            reject(error)
+        })
+    }).catch((err) => {
         if (retry > 0) {
             console.log(`${l.name(pkg.name)} ↻ Retrying (${MAX_RETRIES - (retry - 1)}/${MAX_RETRIES}) building types for ${pkg.name}`)
             return generateTypes(cwd, pkg, retry - 1)
diff --git a/packages/create-wdio/src/constants.ts b/packages/create-wdio/src/constants.ts
@@ -437,7 +437,7 @@ export const QUESTIONNAIRE = [{
     default: 'LT_USERNAME',
     when: /* istanbul ignore next */ (answers: Questionnair) => (
         answers.backend && answers.backend.indexOf('LambdaTest') > -1 &&
-        answers.hostname!.indexOf('lambdatest.com') > -1
+        (answers.hostname === 'lambdatest.com' || answers.hostname?.endsWith('.lambdatest.com'))
     )
 }, {
     type: 'input',
@@ -446,7 +446,7 @@ export const QUESTIONNAIRE = [{
     default: 'LT_ACCESS_KEY',
     when: /* istanbul ignore next */ (answers: Questionnair) => (
         answers.backend && answers.backend.indexOf('LambdaTest') > -1 &&
-        answers.hostname!.indexOf('lambdatest.com') > -1
+        (answers.hostname === 'lambdatest.com' || answers.hostname?.endsWith('.lambdatest.com'))
     )
 }, {
     type: 'input',
diff --git a/packages/wdio-browserstack-service/src/ai-handler.ts b/packages/wdio-browserstack-service/src/ai-handler.ts
@@ -61,7 +61,7 @@ class AiHandler {
         const sessionId = browser.sessionId
 
         // a utility function to escape single and double quotes
-        const escapeString = (str: string) => str.replace(/'/g, "\\'").replace(/"/g, '\\"')
+        const escapeString = (str: string) => str.replace(/\\/g, '\\\\').replace(/'/g, "\\'").replace(/"/g, '\\"').replace(/\n/g, '\\n').replace(/\r/g, '\\r').replace(/\t/g, '\\t')
 
         const tcgDetails = escapeString(JSON.stringify({
             region: TCG_INFO.tcgRegion,
diff --git a/packages/wdio-browserstack-service/src/util.ts b/packages/wdio-browserstack-service/src/util.ts
@@ -1129,7 +1129,7 @@ export function isBrowserstackInfra(config: BrowserstackConfig & Options.Testrun
     // In case hostname is not present anywhere in the config, it returns true by default as hostname is not a mandatory parameter in the config
 
     const isBrowserstack = (str: string ): boolean => {
-        return str.includes('browserstack.com')
+        return str === 'browserstack.com' || str.endsWith('.browserstack.com')
     }
 
     if ((config.hostname) && !isBrowserstack(config.hostname)) {
@@ -1652,12 +1652,27 @@ export function getBooleanValueFromString(value: string | undefined): boolean {
     return ['true'].includes(value.trim().toLowerCase())
 }
 
+/**
+ * Checks if a key is safe to use for object property assignment to prevent prototype pollution
+ * @param key - The key to check
+ * @returns true if the key is safe, false otherwise
+ */
+function isSafeKey(key: string): boolean {
+    const dangerousKeys = ['__proto__', 'constructor', 'prototype']
+    return !dangerousKeys.includes(key)
+}
+
 export function mergeDeep(target: Record<string, any>, ...sources: any[]): Record<string, any> {
     if (!sources.length) {return target}
     const source = sources.shift()
 
     if (isObject(target) && isObject(source)) {
         for (const key in source) {
+            // Skip dangerous keys that could lead to prototype pollution
+            if (!isSafeKey(key)) {
+                continue
+            }
+
             const sourceValue = source[key]
             const targetValue = target[key]
 
diff --git a/packages/wdio-cucumber-framework/src/utils.ts b/packages/wdio-cucumber-framework/src/utils.ts
@@ -222,7 +222,7 @@ export function generateSkipTagsFromCapabilities(capabilities: Capabilities.Reso
                 .find((filter: WebdriverIO.Capabilities) => Object.keys(filter)
                     .every((key: keyof WebdriverIO.Capabilities) => match((capabilities as Record<string, string>)[key], filter[key] as RegExp)))
             if (isSkip) {
-                generatedTags.push(`(not ${tag.replace(/(\(|\))/g, '\\$1')})`)
+                generatedTags.push(`(not ${tag.replace(/[()[\]{}^$*+?.|\\]/g, '\\$&')})`)
             }
         }
     })
diff --git a/packages/wdio-json-reporter/package.json b/packages/wdio-json-reporter/package.json
@@ -38,7 +38,8 @@
   "typeScriptVersion": "3.8.3",
   "dependencies": {
     "@wdio/reporter": "workspace:*",
-    "@wdio/types": "workspace:*"
+    "@wdio/types": "workspace:*",
+    "safe-regex2": "^5.0.0"
   },
   "publishConfig": {
     "access": "public"
diff --git a/packages/wdio-json-reporter/src/mergeResults.ts b/packages/wdio-json-reporter/src/mergeResults.ts
@@ -1,5 +1,8 @@
 import fs from 'node:fs/promises'
 import path from 'node:path'
+
+import safeRegexTest from 'safe-regex2'
+
 import type { ResultSet } from './types.js'
 
 const DEFAULT_FILENAME = 'wdio-merged.json'
@@ -28,7 +31,25 @@ export default async function mergeResults(
 }
 
 async function getDataFromFiles (dir: string, filePattern: string | RegExp) {
-    const fileNames = (await fs.readdir(dir)).filter((file) => file.match(filePattern))
+    let safePattern: RegExp
+
+    if (filePattern instanceof RegExp) {
+        // For existing RegExp objects, test them for safety
+        safePattern = safeRegexTest(filePattern) ? filePattern : /\.json$/
+    } else if (typeof filePattern === 'string') {
+        try {
+            // Test the created RegExp for safety
+            safePattern = safeRegexTest(filePattern) ? new RegExp(filePattern) : /\.json$/
+        } catch {
+            // If the pattern syntax is invalid, fall back to a safe default
+            safePattern = /\.json$/
+        }
+    } else {
+        // If pattern is unsafe or invalid, use a safe default
+        safePattern = /\.json$/
+    }
+
+    const fileNames = (await fs.readdir(dir)).filter((file) => file.match(safePattern))
     const data: unknown[] = []
 
     await Promise.all(fileNames.map(async (fileName) => {
diff --git a/packages/wdio-json-reporter/tsconfig.json b/packages/wdio-json-reporter/tsconfig.json
@@ -3,7 +3,8 @@
   "compilerOptions": {
     "baseUrl": ".",
     "outDir": "./build",
-    "rootDir": "./src"
+    "rootDir": "./src",
+    "allowSyntheticDefaultImports": true
   },
   "include": [
     "src/**/*",
diff --git a/packages/wdio-logger/package.json b/packages/wdio-logger/package.json
@@ -40,6 +40,7 @@
     "chalk": "^5.1.2",
     "loglevel": "^1.6.0",
     "loglevel-plugin-prefix": "^0.8.4",
+    "safe-regex2": "^5.0.0",
     "strip-ansi": "^7.1.0"
   },
   "publishConfig": {
diff --git a/packages/wdio-logger/src/utils.ts b/packages/wdio-logger/src/utils.ts
@@ -1,3 +1,5 @@
+import safeRegexTest from 'safe-regex2'
+
 export const SENSITIVE_DATA_REPLACER = '**MASKED**'
 
 const skipError = (aFunction: Function) => {
@@ -21,15 +23,20 @@ export const parseMaskingPatterns = (maskingRegexString: string | undefined) =>
 
     return regexStrings?.map((regexStr) => {
         const regexParts = regexStr.match(/^\/(.*?)\/([gimsuy]*)$/)
-        if (!regexParts) {
+        if (!regexParts && safeRegexTest(regexStr)) {
             // When passing only a simple string without `/` or flags, aka `(--key=)([^ ]*)`
             return skipError(() => new RegExp(regexStr))
-        } else if (regexParts?.[1]) {
+        }
+
+        if (regexParts?.[1] && safeRegexTest(regexParts[1])) {
             // Case with flag `/(--key=)([^ ]*)/i` or without flag `/(--key=)([^ ]*)/`
-            return skipError(() => regexParts[2] ? new RegExp(regexParts[1], regexParts[2]) : new RegExp(regexParts[1]))
+            return  skipError(() => (
+                regexParts[2]
+                    ? new RegExp(regexParts[1], regexParts[2])
+                    : new RegExp(regexParts[1])))
         }
-        return undefined
 
+        return undefined
     }).filter((regex) => regex !== undefined)
 }
 
diff --git a/packages/wdio-logger/tests/utils.test.ts b/packages/wdio-logger/tests/utils.test.ts
@@ -229,4 +229,4 @@ describe('wdio-logger utils', () => {
             expect(maskedValue).toEqual('RESULT **MASKED**\n')
         })
     })
-})
+})
diff --git a/packages/wdio-logger/tsconfig.json b/packages/wdio-logger/tsconfig.json
@@ -3,7 +3,8 @@
   "compilerOptions": {
     "baseUrl": ".",
     "outDir": "./build",
-    "rootDir": "./src"
+    "rootDir": "./src",
+    "allowSyntheticDefaultImports": true
   },
   "include": [
     "src/**/*",
diff --git a/packages/wdio-mocha-framework/src/common.ts b/packages/wdio-mocha-framework/src/common.ts
@@ -119,7 +119,7 @@ export function requireExternalModules (mods: string[], loader = loadModule) {
             return Promise.resolve()
         }
 
-        mod = mod.replace(/.*:/, '')
+        mod = mod.includes(':') ? mod.substring(mod.lastIndexOf(':') + 1) : mod
 
         if (mod.startsWith('./') && globalThis.process) {
             mod = `${globalThis.process.cwd()}/${mod.slice(2)}`
diff --git a/packages/wdio-utils/package.json b/packages/wdio-utils/package.json
@@ -42,7 +42,7 @@
     "@wdio/types": "workspace:*",
     "decamelize": "^6.0.0",
     "deepmerge-ts": "^7.0.3",
-    "edgedriver": "^6.1.1",
+    "edgedriver": "^6.1.2",
     "geckodriver": "^5.0.0",
     "get-port": "^7.0.0",
     "import-meta-resolve": "^4.0.0",
diff --git a/packages/wdio-utils/src/node/utils.ts b/packages/wdio-utils/src/node/utils.ts
@@ -66,10 +66,18 @@ export function getBuildIdByChromePath(chromePath?: string) {
         return oldest
     }
 
-    const versionString = cp.execSync(`"${chromePath}" --version --no-sandbox`).toString()
-    const versionSanitized = versionString.trim().split(' ').find((s) => s.split('.').length === 4)
+    const result = cp.spawnSync(chromePath, ['--version', '--no-sandbox'], {
+        encoding: 'utf8',
+        env: process.env
+    })
+
+    if (result.error) {
+        throw result.error
+    }
+
+    const versionSanitized = result.stdout.trim().split(' ').find((s) => s.split('.').length === 4)
     if (!versionSanitized) {
-        throw new Error(`Couldn't find valid Chrome version from "${versionString}", please raise an issue in the WebdriverIO project (https://github.com/webdriverio/webdriverio/issues/new/choose)`)
+        throw new Error(`Couldn't find valid Chrome version from "${result.stdout}", please raise an issue in the WebdriverIO project (https://github.com/webdriverio/webdriverio/issues/new/choose)`)
     }
     return versionSanitized
 }
@@ -85,12 +93,20 @@ export async function getBuildIdByFirefoxPath(firefoxPath?: string) {
         return contents
             .split('\n')
             .filter((line) => line.startsWith('Version='))
-            .map((line) => line.replace('Version=', '').replace(/\r/, ''))
+            .map((line) => line.replace(/Version=/g, '').replace(/\r/g, ''))
             .pop()
     }
 
-    const versionString = cp.execSync(`"${firefoxPath}" --version`).toString()
-    return versionString.trim().split(' ').pop()?.trim()
+    const result = cp.spawnSync(firefoxPath, ['--version'], {
+        encoding: 'utf8',
+        env: process.env
+    })
+
+    if (result.error) {
+        throw result.error
+    }
+
+    return result.stdout.trim().split(' ').pop()?.trim()
 }
 
 let lastTimeCalled = Date.now()
diff --git a/packages/wdio-utils/src/utils.ts b/packages/wdio-utils/src/utils.ts
@@ -88,7 +88,7 @@ export function commandCallStructure (commandName: string, args: unknown[], unfu
              *  - Returned async functions: `return async function` or `return (async function`
              *  - Arrow functions: `() =>` or `param =>` or `(param1, param2) =>`
              */
-            /^\s*(?:(?:async\s+)?function\s*[\w\s]*\(|!function\(|return\s+\(?(?:async\s+)?function|\(?\w*(?:\s*,\s*\w+)*\)?\s*=>)/.test(arg.trim())
+            /^\s*(?:(?:async\s+)?function(?:\s+\w+)?\s*\(|!function\(|return\s+\(?(?:async\s+)?function|\([^)]*\)\s*=>|\w+\s*=>)/.test(arg.trim())
         ) {
             arg = '<fn>'
         } else if (
diff --git a/packages/wdio-utils/tests/node/utils.test.ts b/packages/wdio-utils/tests/node/utils.test.ts
@@ -59,7 +59,8 @@ vi.mock('node:fs/promises', () => ({
 
 vi.mock('node:child_process', () => ({
     default: {
-        execSync: vi.fn()
+        execSync: vi.fn(),
+        spawnSync: vi.fn()
     }
 }))
 
@@ -75,7 +76,14 @@ vi.mock('@puppeteer/browsers', () => ({
 
 describe('driver utils', () => {
     beforeEach(() => {
-        vi.mocked(cp.execSync).mockReturnValue(Buffer.from('Google Chrome 116.0.5845.110 \n'))
+        vi.mocked(cp.spawnSync).mockReturnValue({
+            pid: 123,
+            output: [],
+            stdout: 'Google Chrome 116.0.5845.110 \n',
+            stderr: '',
+            status: 0,
+            signal: null
+        })
     })
 
     it('should parse params', () => {
@@ -86,10 +94,24 @@ describe('driver utils', () => {
     it('getBuildIdByChromePath', () => {
         expect(getBuildIdByChromePath()).toBe(undefined)
         expect(getBuildIdByChromePath('/foo/bar')).toBe('116.0.5845.110')
-        expect(cp.execSync).toBeCalledWith('"/foo/bar" --version --no-sandbox')
-        vi.mocked(cp.execSync).mockReturnValue(Buffer.from('Chromium 117.0.5938.88 Fedora Project \n'))
+        expect(cp.spawnSync).toBeCalledWith('/foo/bar', ['--version', '--no-sandbox'], expect.any(Object))
+        vi.mocked(cp.spawnSync).mockReturnValue({
+            pid: 123,
+            output: [],
+            stdout: 'Chromium 117.0.5938.88 Fedora Project \n',
+            stderr: '',
+            status: 0,
+            signal: null
+        })
         expect(getBuildIdByChromePath('/foo/bar')).toBe('117.0.5938.88')
-        vi.mocked(cp.execSync).mockReturnValue(Buffer.from('Chromium 117.0.5938.92 snap \n'))
+        vi.mocked(cp.spawnSync).mockReturnValue({
+            pid: 123,
+            output: [],
+            stdout: 'Chromium 117.0.5938.92 snap \n',
+            stderr: '',
+            status: 0,
+            signal: null
+        })
         expect(getBuildIdByChromePath('/foo/bar')).toBe('117.0.5938.92')
         vi.mocked(os.platform).mockReturnValueOnce('win32')
         expect(getBuildIdByChromePath('/foo/bar')).toBe('115.0.5790.110')
diff --git a/packages/webdriver/src/utils.ts b/packages/webdriver/src/utils.ts
@@ -376,7 +376,7 @@ export const getSessionError = (err: JSONWPCommandError, params: Partial<Options
             '\nIf you use a grid server ' + w3cCapMessage
     }
 
-    if (err.message.includes('failed serving request POST /wd/hub/session: Unauthorized') && params.hostname?.endsWith('saucelabs.com')) {
+    if (err.message.includes('failed serving request POST /wd/hub/session: Unauthorized') && (params.hostname === 'saucelabs.com' || params.hostname?.endsWith('.saucelabs.com'))) {
         return 'Session request was not authorized because you either did provide a wrong access key or tried to run ' +
             'in a region that has not been enabled for your user. If have registered a free trial account it is connected ' +
             'to a specific region. Ensure this region is set in your configuration (https://webdriver.io/docs/options.html#region).'
diff --git a/packages/webdriverio/src/commands/element.ts b/packages/webdriverio/src/commands/element.ts
@@ -18,7 +18,7 @@ export * from './element/getElement.js'
  * don't expose this method as it should not be attached to the `WebdriverIO.Element` prototype.
  */
 // export * from './element/getElements.js'
-export * from './element/getHTML.js'
+export { getHTML } from './element/getHTML.js'
 export * from './element/getLocation.js'
 export * from './element/getProperty.js'
 export * from './element/getSize.js'
diff --git a/packages/webdriverio/src/commands/element/getHTML.ts b/packages/webdriverio/src/commands/element/getHTML.ts
diff --git a/packages/webdriverio/src/utils/findStrategy.ts b/packages/webdriverio/src/utils/findStrategy.ts
diff --git a/packages/webdriverio/tests/commands/element/getHTML.test.ts b/packages/webdriverio/tests/commands/element/getHTML.test.ts
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/scripts/bidi/downloadSpec.ts b/scripts/bidi/downloadSpec.ts
