Harden BrowserStack URL output in E2E tests#20011
Harden BrowserStack URL output in E2E tests#20011dimitrop wants to merge 3 commits intophpmyadmin:masterfrom
Conversation
dimitrop
force-pushed
the
fix/tests-output-hardening
branch
from
b737a0d to
1d8ae90
Compare
Signed-off-by: dimitrop <dimitris.i.mitropoulos@gmail.com>
dimitrop
force-pushed
the
fix/tests-output-hardening
branch
from
1d8ae90 to
a8490a4
Compare
Signed-off-by: dimitrop <dimitris.i.mitropoulos@gmail.com>
Signed-off-by: dimitrop <dimitris.i.mitropoulos@gmail.com>
dimitrop
force-pushed
the
fix/tests-output-hardening
branch
from
dd74ab2 to
aba718b
Compare
williamdes
left a comment
williamdes
left a comment
There was a problem hiding this comment.
Do you have some examples?
The value printed here originates from an external API response (BrowserStack) and is echoed directly to test output. While this code path is limited to CI and test environments, the data is still externally sourced. For example, consider a case where the returned URL includes control characters such as newlines, carriage returns, or ANSI escape sequences. If printed verbatim, these can alter log structure, inject misleading log entries, or potentially influence terminal rendering. Stripping control characters ensures that the output remains well-formed, readable, and safe for consumption by CI logs, terminals, and log processors, without changing the functional behavior of the tests. This hardening aligns with established guidance on handling externally influenced output, even outside user-facing contexts (e.g. https://cwe.mitre.org/data/definitions/117.html) |
|
I am sorry but I can not see any real world example or impact |
3 participants
Description
This change hardens the output of the BrowserStack session URL printed by end-to-end tests.
The URL is obtained from an external API response and echoed directly to the test output. While this code path is only used in CI / test environments, the value is still externally sourced and unvalidated.
This patch strips control characters from the URL before printing it, ensuring the output remains well-formed and preventing potential log or terminal control issues.
Fixes # (none)
Notes
Checklist