CodeVetter · Repo Unpack · Risk map
webdriverio/webdriverio
These are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. The most consequential boundaries accept executable configuration, launch processes, communicate with drivers, and write caller-selected artifacts. Credential transport and logging depend on protocol and masking choices. Testing configuration and browser compatibility branches also create limits on what source inspection alone can establish.
- Configuration and plugins are executable inputs: ConfigParser imports the selected config module, initializePlugin imports scoped/absolute or convention-derived modules, and automationProtocol can select a dynamically imported driver.
- Process-launch boundaries inherit environment settings and accept runtime arguments; Chromium startup can download/select a driver binary, defaults allowedOrigins to '*' and allowedIps to '0.0.0.0', and accepts spawnOpts overrides.
- BiDi connection options follow up to ten redirects and forward custom headers; strictSSL=false disables certificate verification. The source explicitly identifies cross-host credential forwarding as a consequence of misconfigured redirects.
- HTTP session authentication uses a Basic header on /session. LambdaTest auto-detection defaults to HTTP port 80 unless overridden, and enabled Appium direct connection replaces host/protocol/path/port from returned capabilities.
- Input masking covers selected request/log payloads, but command result values are logged; the e2e masked-input example explicitly warns that a later getValue exposes the password in logs.
- Screenshot writes resolve caller paths without a repository-root constraint. BrowserRunner.initialize recursively removes an existing configured reports directory when clean is absent or true, so artifact configuration controls filesystem effects.
- Shared-store routes bind to loopback and expose get/set/pool operations without authentication middleware in the inspected chain. validateBody checks only paths ending /get or /set, while the primary setter is POST /; this mismatch warrants investigation, not a confirmed exploit claim.
- Hypothesis: compatibility regressions may escape narrow mocked checks because locator behavior combines protocol fallbacks, browser-version workarounds, shadow-root state, and stale-element recovery, while unit configuration suppresses unhandled-error and default coverage signals. (inferred)