feat(runner+browserstack): Mask sensitive data for Reporters (and more) #13938

dprevost-LMI · 2024-12-01T15:52:57Z

Proposed changes

To provide easier security, here is a PR which has two main goals:

On the element.setValue, add a new boolean mask option allowing to mask from everyone besides appium the value set in an input element. This allows with the simple {mask : true} to hide the password, for example, of a real production user from wdio logs, any reporters, the performance tool and anyone listening on any emit. The cherry on top is the participation of appium's folks, where even in Appium's logs (see PR), this value continues to be masked with the simple boolean options. 🎉
- Note: Some limitations exist
  1. Appium plugins, which we do not have control over.
  2. Only setValue and addValue commands are supported. Not the getValue, for example.
A regex expression can now be configured in the wdio logs to hide more sensitive information. For example, when using BrowserStack, the user's key is in plain text. Now we can pass a simple regex pattern like maskingPattern: '--key=([^ ]*)', which will mask this value in the logs.

See the issue for the history of the discussion that led to the PR decisions.

Example for case 1:
Logs:

Allure-reporter

Example for case 2:

Types of changes

~~Polish (an improvement for an existing feature)~~
~~Bugfix (non-breaking change which fixes an issue)~~
New feature (non-breaking change which adds functionality)
~~Breaking change (fix or feature that would cause existing functionality to not work as expected)~~
Documentation update (improvements to the project's docs)
~~Specification changes (updates to WebDriver command specifications)~~
~~Internal updates (everything related to internal scripts, governance documentation and CI files)~~

Checklist

I have read the CONTRIBUTING doc
I have added tests that prove my fix is effective or that my feature works
I have added the necessary documentation (if appropriate)
I have added proper type definitions for new commands (if appropriate)

Backport Request

This change is solely for v9 and doesn't need to be back-ported
~~Back-ported PR at #XXXXX~~

Further comments

Reviewers: @webdriverio/project-committers

Related to issue #13937
Appium-related issue

pkg-pr-new · 2024-12-01T15:55:53Z

Open in StackBlitz

eslint-plugin-wdio

npm i https://pkg.pr.new/webdriverio/webdriverio/eslint-plugin-wdio@13938

@wdio/allure-reporter

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/allure-reporter@13938

@wdio/appium-service

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/appium-service@13938

@wdio/browser-runner

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/browser-runner@13938

@wdio/browserstack-service

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/browserstack-service@13938

@wdio/cli

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/cli@13938

@wdio/concise-reporter

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/concise-reporter@13938

@wdio/config

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/config@13938

@wdio/cucumber-framework

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/cucumber-framework@13938

@wdio/dot-reporter

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/dot-reporter@13938

@wdio/firefox-profile-service

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/firefox-profile-service@13938

@wdio/globals

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/globals@13938

@wdio/jasmine-framework

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/jasmine-framework@13938

@wdio/json-reporter

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/json-reporter@13938

@wdio/junit-reporter

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/junit-reporter@13938

@wdio/lighthouse-service

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/lighthouse-service@13938

@wdio/local-runner

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/local-runner@13938

@wdio/logger

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/logger@13938

@wdio/mocha-framework

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/mocha-framework@13938

@wdio/protocols

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/protocols@13938

@wdio/repl

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/repl@13938

@wdio/reporter

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/reporter@13938

@wdio/runner

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/runner@13938

@wdio/sauce-service

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/sauce-service@13938

@wdio/shared-store-service

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/shared-store-service@13938

@wdio/smoke-test-cjs-service

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/smoke-test-cjs-service@13938

@wdio/smoke-test-reporter

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/smoke-test-reporter@13938

@wdio/smoke-test-service

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/smoke-test-service@13938

@wdio/spec-reporter

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/spec-reporter@13938

@wdio/static-server-service

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/static-server-service@13938

@wdio/sumologic-reporter

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/sumologic-reporter@13938

@wdio/testingbot-service

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/testingbot-service@13938

@wdio/types

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/types@13938

@wdio/utils

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/utils@13938

@wdio/webdriver-mock-service

npm i https://pkg.pr.new/webdriverio/webdriverio/@wdio/webdriver-mock-service@13938

webdriver

npm i https://pkg.pr.new/webdriverio/webdriverio/webdriver@13938

webdriverio

npm i https://pkg.pr.new/webdriverio/webdriverio@13938

commit: c86527d

christian-bromann

Some comments

packages/webdriver/src/command.ts

packages/wdio-types/src/Capabilities.ts

packages/webdriver/src/command.ts

christian-bromann · 2024-12-10T18:27:03Z

Just to note here: we are working with different logs:

WDIO logs like in this screenshot:
Appium logs that Appium is creating and may be intercepted by WebdriverIO
Vendor logs

It would be awesome if the solution:

sends the actual value to Appium, e.g. when calling $('selector').setValue(process.env.SECRET_PASSWORD) but masks them in the wdio logs which requires changes to transformCommandLogResult
applies automatically log filters to Appium when user uses @wdio/appium-service and warns the user to apply them when an independent Appium server is being used

I am open to how the mask option look like as long as it is intuitive. Maybe there is an NPM package that detects secrets and can give us an indication whether we should mask it. Otherwise aligning with what Appium does makes total sense to me.

I don't think we can do anything about what the Vendor displays in their UI.

Hope this makes sense. Please let me know.

dprevost-LMI · 2024-12-12T00:58:04Z

Let's settle this in the issue! #13937 (comment)

packages/wdio-logger/src/index.ts

packages/wdio-protocols/src/protocols/webdriver.ts

packages/webdriver/src/types.ts

packages/webdriverio/src/types.ts

packages/webdriver/tests/command.test.ts

packages/webdriverio/src/types.ts

packages/webdriver/tests/utils.test.ts

Co-authored-by: Christian Bromann <[email protected]>

christian-bromann

Should we add some documentation for the new property somewhere here? I think it would help folks to discover this feature much better. I think we can just copy the docs from the logger readme file.

dprevost-LMI · 2025-05-29T16:29:21Z

In addition to your request (done in 0708a6d), I had considered that a new "Security" section on the wdio website would be helpful.
Some idea I had for the page:

Document the regular expression added from this PR for logs
Document the { mask: true }, for user's password additional security
Add the workaround of silencing the logger like below

/**
 * Set the logger level of the webdriver logger to 'error' before running a promise which is useful to hide sensitive information in the logs.
 */
export const withSilentLogger = async <T>(promise: () => Promise<T>): Promise<T> => {
  const webdriverLogLevel = driver.options.logLevel ?? 'error';

  try {
    logger.setLevel('webdriver', 'silent');
    return await promise();
  } finally {
    logger.setLevel('webdriver', webdriverLogLevel);
  }
};

Point to the appium log filtering: https://appium.io/docs/en/2.0/guides/log-filters/
Point to the BrowserStack masking: https://www.browserstack.com/docs/automate/selenium/hide-sensitive-data
Maybe more...

What do you think?

christian-bromann · 2025-05-29T16:49:03Z

What do you think?

Great idea! Let's do this.

website/docs/Security.md

…n' into masked-sensible-information

christian-bromann

Amazing stuff 🙌

wdio-bot · 2025-05-30T18:08:37Z

Hey dprevost-LMI 👋

Thank you for your contribution to WebdriverIO! Your pull request has been marked as an "Expensable" contribution.

We've sent you an email with further instructions on how to claim your expenses from our development fund.
Please make sure to check your spam folder as well. If you have any questions, feel free to reach out to us at [email protected] or in the contributing channel on Discord.

We are looking forward to more contributions from you in the future 🙌

Have a nice day,
The WebdriverIO Team 🤖

dprevost-LMI changed the title ~~[FEATURE] Masking sensitive data for Reporters and other tools using onBeforeComand & onAfterCommand~~ [FEATURE]: Masking sensitive data for Reporters and other tools using onBeforeComand & onAfterCommand Dec 1, 2024

dprevost-LMI mentioned this pull request Dec 1, 2024

[💡 Feature]: Proper masking for reporters, logging, and multiple emit events #13937

Closed

1 task

dprevost-LMI changed the title ~~[FEATURE]: Masking sensitive data for Reporters and other tools using onBeforeComand & onAfterCommand~~ feat(runner+browserstack) Masking sensitive data for Reporters and other tools using onBeforeComand & onAfterCommand Dec 2, 2024

dprevost-LMI changed the title ~~feat(runner+browserstack) Masking sensitive data for Reporters and other tools using onBeforeComand & onAfterCommand~~ feat(runner+browserstack) Mask sensitive data for Reporters and other tools on the before/after hook Dec 2, 2024

dprevost-LMI changed the title ~~feat(runner+browserstack) Mask sensitive data for Reporters and other tools on the before/after hook~~ feat(runner+browserstack) Mask sensitive data for Reporters (and more) on the before/after hook Dec 2, 2024

dprevost-LMI changed the title ~~feat(runner+browserstack) Mask sensitive data for Reporters (and more) on the before/after hook~~ feat(runner+browserstack): Mask sensitive data for Reporters (and more) on the before/after hook Dec 2, 2024

dprevost-LMI force-pushed the masked-sensible-information branch from f1c6a2e to 13570dc Compare December 8, 2024 19:38

christian-bromann reviewed Dec 9, 2024

View reviewed changes

packages/webdriver/src/command.ts Outdated Show resolved Hide resolved

packages/webdriver/src/command.ts Outdated Show resolved Hide resolved

packages/wdio-types/src/Capabilities.ts Outdated Show resolved Hide resolved

packages/webdriver/src/command.ts Outdated Show resolved Hide resolved

dprevost-LMI force-pushed the masked-sensible-information branch 2 times, most recently from 7a712fc to b6a4f6c Compare December 10, 2024 00:04

dprevost-LMI changed the title ~~feat(runner+browserstack): Mask sensitive data for Reporters (and more) on the before/after hook~~ feat(runner+browserstack): Mask sensitive data for Reporters (and more) Dec 10, 2024

christian-bromann linked an issue Dec 10, 2024 that may be closed by this pull request

[💡 Feature]: Proper masking for reporters, logging, and multiple emit events #13937

Closed

1 task

christian-bromann added the Expensable $100 💸 label Dec 10, 2024

dprevost-LMI force-pushed the masked-sensible-information branch from 33f944e to 71c8369 Compare January 25, 2025 19:49

dprevost-LMI force-pushed the masked-sensible-information branch from 71c8369 to f7489c7 Compare March 16, 2025 01:08

dprevost-LMI requested review from christian-bromann and zyntax90 March 16, 2025 01:48

dprevost-LMI force-pushed the masked-sensible-information branch 2 times, most recently from 1fdd837 to b9e3b25 Compare March 21, 2025 12:22

christian-bromann reviewed Mar 23, 2025

View reviewed changes

packages/wdio-logger/src/index.ts Outdated Show resolved Hide resolved

packages/wdio-logger/src/index.ts Outdated Show resolved Hide resolved

packages/wdio-protocols/src/protocols/webdriver.ts Outdated Show resolved Hide resolved

dprevost-LMI force-pushed the masked-sensible-information branch from 7cf4895 to 3a088a9 Compare May 10, 2025 17:11