Description: Enabling verbose/debug driver logging automatically when WebDriver.logger.debug? is true
(also in Edge/Firefox/IE service initializers) may cause sensitive data (URLs with tokens,
cookies, PII in form values, internal paths) to be written to logs in environments where
debug is enabled unintentionally or logs are centrally collected.
service.rb [29-37]

def initialize(path: nil, port: nil, log: nil, args: nil)
  args ||= []
  if WebDriver.logger.debug?
    args.reject! { |arg| arg.start_with?('--log-level') }
    args << '--verbose'
  end

  super
end

Follow the guide to enable codebase context checks.

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status:
Verbose logging risk: Enabling driver --verbose (and similar debug flags across drivers) when
WebDriver.logger.debug? is true may cause sensitive data (e.g., URLs with credentials,
session identifiers, or other request details) to be written to logs depending on driver
behavior and should be reviewed/guarded accordingly.

def initialize(path: nil, port: nil, log: nil, args: nil)
  args ||= []
  if WebDriver.logger.debug?
    args.reject! { |arg| arg.start_with?('--log-level') }
    args << '--verbose'
  end

Learn more about managing compliance generic rules or creating your own custom rules

Fix a potential crash by changing Array(args.dup) to Array(args).dup to safely
handle cases where args is nil.

rb/lib/selenium/webdriver/chrome/service.rb [29-37]

 def initialize(args: nil, **)
   if ENV.key?('SE_DEBUG')
-    args = Array(args.dup)
+    args = Array(args).dup
     warn_driver_log_override if args.reject! { |arg| arg.include?('log-level') || arg.include?('silent') }
     args << '--verbose'
   end
 
   super
 end

• Apply / Chat

Fix a potential crash by changing Array(args.dup) to Array(args).dup to safely
handle cases where args is nil.

rb/lib/selenium/webdriver/firefox/service.rb [29-42]

 def initialize(args: nil, **)
-  args = Array(args.dup)
+  args = Array(args).dup
   unless args.any? { |arg| arg.include?('--connect-existing') || arg.include?('--websocket-port') }
     args << '--websocket-port'
     args << '0'
   end
 
   if ENV.key?('SE_DEBUG')
     remove_log_args(args)
     args << '-v'
   end
 
   super
 end

• Apply / Chat

Change the condition for redirecting driver process IO from ENV.key?('SE_DEBUG')
to WebDriver.logger.debug? to ensure driver logs are always enabled when any
debug flag is active.

rb/lib/selenium/webdriver/common/service_manager.rb [83-90]

-if ENV.key?('SE_DEBUG')
+if WebDriver.logger.debug?
   if @io && @io != WebDriver.logger.io
-    WebDriver.logger.warn('SE_DEBUG is set; overriding user-specified driver log output to use stderr',
+    WebDriver.logger.warn('Debug logging is enabled; overriding user-specified driver log output to use stderr',
                           id: :se_debug)
   end
   @io = WebDriver.logger.io
 end
 @process.io = @io if @io

• Apply / Chat

Always defensively copy args (not only when SE_DEBUG is set) so later internal
mutations can’t affect the caller’s array. Initialize args as Array(args).dup up
front, then apply conditional modifications.

rb/lib/selenium/webdriver/chrome/service.rb [29-37]

 def initialize(args: nil, **)
+  args = Array(args).dup
   if ENV.key?('SE_DEBUG')
-    args = Array(args.dup)
     warn_driver_log_override if args.reject! { |arg| arg.include?('log-level') || arg.include?('silent') }
     args << '--verbose'
   end
 
   super
 end

• Apply / Chat

Treat SE_DEBUG as enabled only when it has a meaningful value (e.g., not blank
and not “0”) to avoid unexpected behavior when the key exists but is effectively
false. Compute a boolean (e.g., se_debug = ...) and use it instead of ENV.key?.

rb/lib/selenium/webdriver.rb [99-104]

+se_debug = (ENV['SE_DEBUG'] || '').strip
+se_debug_enabled = !se_debug.empty? && se_debug != '0'
+
 @logger ||= WebDriver::Logger.new('Selenium', default_level: level, **).tap do |logger|
-  if ENV.key?('SE_DEBUG')
+  if se_debug_enabled
     logger.debug!
     logger.stderr!
   end
 end

• Apply / Chat