Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How do I protect the ports that chromedriver use?

Normally when I run chromedriver I always get this output which I'm sure everyone gets when running chromedriver. It's not the whole output but about a specif sentence.

Only local connections are allowed. 
Please protect ports used by ChromeDriver and related test frameworks to prevent access by malicious code.

As the title says and the output I always get. How do I make sure that the ports ChromeDriver is using only protected ports?

like image 323
Lewiad Avatar asked Mar 31 '19 15:03

Lewiad


People also ask

What port does Selenium Webdriver use?

To start nodes open the command prompt and navigate to the directory, where the Selenium Server Standalone jar file is stored. When -role option that is provided is not specified, and it is not the hub, the default port is 5555.

How can we set the system property for ChromeDriver?

Any of these steps should do the trick: include the ChromeDriver location in your PATH environment variable. (Java only) specify its location via the webdriver.chrome.driver system property (see sample below) (Python only) include the path to ChromeDriver when instantiating webdriver.Chrome (see sample below)

What is default location ChromeDriver?

Default location on Windows is: C:\Program Files\(select the folder you want to put your file)\chromedriver.exe. In your Selenium code, paste the driver path correctly, for example: System.setProperty("webdriver.chrome.driver", "C:\\Program Files\\Java\\chromedriver.exe");

Which protocol is used by ChromeDriver that is supported by Selenium?

Google Chrome's DevTools make use of a protocol called the Chrome DevTools Protocol (or “CDP” for short).


1 Answers

This INFO message...

Please protect ports used by ChromeDriver and related test frameworks to prevent access by malicious code.

... was the result of a bug which got induced with ChromeDriver v2.46


Analysis

As per the discussion 2.46 produces unexpected debug.log file if verbose logging is enabled, within the InitLogging() function of logging.cc some logging messages were written too early even before logging::InitLogging is called (at the last line of the function). This turned out to be OK on Linux and Mac OS, where the default log destination is where it is expected. But on Windows, the default log destination is a file named debug.log.

So ChromeDriver team needed to remove the two VLOG calls to the end of the method, after calling logging::InitLogging.

This issue was addressed through a commit and the fix was available within ChromeDriver 73.x

Protecting the ports that chromedriver use

There is nothing much we can do about the port usage as @barancev mentions ChromeDriver attempts to find a free Ephemeral port using a system-dependent ephemeral port range detector. An ephemeral port is a short-lived endpoint that is created by the operating system when a program requests any available user port. The operating system selects the port number from a predefined range, typically between 1024 and 65535, and releases the port after the related TCP connection terminates.

By default, the system can create a maximum of approximately 4,000 ephemeral ports that run concurrently on Windows Server 2003 and approximately 16,000 on Windows Server 2008.


Solution

Upgrading to ChromeDriver 73.x will solve this issue.


Outro

These log messages were the reflection of ChromeDriver - Security Considerations.

ChromeDriver is a powerful tool, and it can cause harms in the wrong hands. While using ChromeDriver, please follow these suggestions to help keeping it safe:

  • By default, ChromeDriver only allows local connections. If you need to connect to it from a remote host, use --whitelisted-ips switch on the command line to specify a list of IP addresses that are allowed to connect to ChromeDriver.
  • If possible, run ChromeDriver with a test account that has no access to sensitive local or network data. ChromeDriver should never be run with a privileged account.
  • If possible, run ChromeDriver in a protected environment such as Docker or virtual machine.
  • Use firewall to prevent unauthorized remote connection to ChromeDriver.
  • If you are using ChromeDriver through third-party tools such as Selenium Server, be sure to protect the network ports of those tools as well.
  • Use the latest versions of ChromeDriver and Chrome.

You can find the list of restricted ports on Chrome here.

like image 123
undetected Selenium Avatar answered Sep 24 '22 18:09

undetected Selenium