Not all coders are created equal. But there should be a line where we collectively just say, “Please stop”.
Would like to say found two critical issues in two Python packages, but it’s obvious to a six year old. Not sure can claim credit for such in your face obvious issues.
And since it’s so obvious, responsible disclosure kinda got kicked to the curb.
These libraries pin the required dependencies and test only one python interpreter, so lets just say had lowered expectations going in.
get-gecko-driver and get-chrome-driver look like they are unneeded since both selenium and webdriver-manager can download selenium webdrivers. In the later two packages, web browser support is sparse; there is room for more flexibility. For example, support for waterfox, librewolf, and mullvad-browser.
Issues summary:
-
downloader module can send a GET request to any URL. There is no URL whitelist. These packages can be used for cover when making arbitrary GET requests.
-
downloader can save anywhere on the file system. So can be used for other purposes besides downloading selenium webdriver.
-
no permission checks before saving/writing the file.
-
get_gecko_driver.downloader and get_chrome_driver.downloader are the exact same module.
I lack confidence the author will respond, will be very pleasantly surprised if the author fix these issues in a timely manner. Nor confidence he’d do a good job. But at least these issues are disclosed and the ball is in his court.
For your entertainment:
All these coding errors are unforgivable and obvious to even a novice coder, a laymen, or a random drunk. It takes talent not to see it. If bothered to do unit testing, would be unavoidable to not see it.
These issues are both CRITICAL SECURITY issues.
Obvious is obvious, don’t kill the messenger, instead lets just fix this issue. The correct action is to quickly fix it and then just agree never to mention it again and pray there is no Darwin award for coders.
You decided not to responsibly disclose a security vulnerability that you assessed to be critical, because you thought it was obvious?
Yes. That would be a fair assessment. Don’t disagree with you.
Do you think made the wrong ethical call? My position is the author isn’t a serious person who’ll:
- respond
- know how to deal with a PR
- care
So it’s better to inform anyone happening upon get-gecko-driver and get-chrome-driver and do it ASAP. Which i did.
If you made no attempt to disclose this to the author before posting here, then I disagree with your judgement on this.
Also way to go not taking the side of:
-
an active member of this community
-
someone understanding and in a position to increase browser support for selenium webdrivers
-
a coder who’d care and doesn’t suck at coding
So what do you get for the Captain Obvious comment besides being right? A clock is right twice a day. But no dopamine hit from a clock.
A better strategy, would be to ask about how to go about increasing selenium web driver browser support and whether a more flexible package is in the works. Not to defend a hopeless package in dire need of a rewrite. Or to provide the info i ask for about how to go about responsibly disclosing security issues.
Understand your heart is in the right place. Hope you can understand that alone isn’t the only consideration or way to look at this. You can press the issue and still come away with nothing.
rinse wash repeat and still the reflex reaction will remain the same. I’m suggesting trying something else.
Okay I think it’s worth responding to these point by point:
Also way to go not taking the side of an active member of this community
I’m not taking sides. Being an active member of a community doesn’t absolve you or anyone else of behaving irresponsibly.
[Also way to go not taking the side of] someone understanding and in a position to increase browser support for selenium webdrivers
I don’t doubt your intention to increase browser support for selenium webdrivers. However I don’t agree with your decision to disclose what you deem a critical security bug without any indication that you attempted to disclose the issue to the project maintainer before advertising the issue here.
[Also way to go not taking the side of] a coder who’d care and doesn’t suck at coding
Your coding ability in this situation is not in question or an issue.
So what do you get for the Captain Obvious comment besides being right? A clock is right twice a day. But no dopamine hit from a clock.
What I got were clarifications to questions I had after reading your original post. I wanted to make sure that I hadn’t made any quick assumptions before I concluded whether or not I thought you had behaved ethically.
A better strategy, would be to ask about how to go about increasing selenium web driver browser support and whether a more flexible package is in the works. Not to defend a hopeless package in dire need of a rewrite. Or to provide the info i ask for about how to go about responsibly disclosing security issues.
Your original post didn’t ask how to responsibly disclose a security issue. And you posted this, by your own admission, without responsibly disclosing.
For future reference, here is how you responsibly disclose critical security issues to a project: you find contact information for a maintainer or, if available, the project’s security team. You send them a message confidentially (email, private message, issue tracker post stating you have found a critical issue you wish to disclose securely). You wait for them to get back to you. If they do, you coordinate a fix, and then you wait for the fix to be released and communicated before releasing details of the issue.
If the maintainer doesn’t get back to you, try another maintainer. If they don’t get back to you, then you’ve done all you can and you can release information on the issue.
Let me ask you: what was your intention behind your original post? You haven’t provided a fix here, or a PR, as far as I can see you haven’t forked the project with a fix. So I don’t understand how doing this makes the situation any better, if anything it’s placed the users of this project at a higher risk.
-
Can you clarify what the problem is?
1 and 2 are not issues by themselves, cURL can do that.
3 is maybe a problem, but surely it doesn’t bypass the filesystem permissions right? If it does, sure, that’s a problem. If not, that’s just curl.
These packages aren’t intended to be curl and they shouldn’t be capable of being curl. So it’s unexpected behavior from these packages. The worst that can happen is use in ddos attacks or sabotaging a user’s files by overwriting them.
The package doesn’t alter fs permissions, but can write anywhere that has permission to do so.
Is this not enough?
Okay, so it can do arbitrary downloads. That’s unideal, but in its normal operation it downloads a full webbrowser that can do arbitrary downloads. And its a thin wrapper around requests, which can do arbitrary downloads. Not sure that’s really a high severity issue imho.
Lets say wanted to responsibly disclose, for a change, these security issues. For future reference, is there a step to step guide for Python on how to do that.
Checked, no code of conduct. Good i’m in the clear.
And get-gecko-driver has 8 stars. Tried to see who starred it. Very kind people who unfortunately are anonymous. While trying to see who starred it, accidentally starred it. Luckily can unstar it, avoiding eternal shame.
Somehow, not by me, the disclosure was deleted. The issues raised have not been addressed. Way to handle it, ignore it. LOL!
So the head in sand approach it is. Or fck off it’s as-is (aka MIT licensed). Either github or the author pulled a MSFT. Unfortunately cannot tell who deleted it.
I feel vindicated. Didn’t get the impression this author can be collaborated with.
