This PR addresses several security vulnerabilities identified through static analysis, implementing comprehensive fixes across multiple packages to strengthen WebdriverIO's security posture.

📋 Summary of Fixes

14 files modified with security improvements across the following categories:

🛡️ Detailed Fixes

ReDoS Prevention

• packages/wdio-logger/src/utils.ts: Added validation for user-provided regex patterns to prevent exponential backtracking
• packages/wdio-json-reporter/src/mergeResults.ts: Implemented safe file pattern validation with fallback to secure defaults
• packages/wdio-utils/src/utils.ts: Fixed catastrophic backtracking in function detection regex
• packages/webdriverio/src/commands/element/getHTML.ts: Optimized HTML comment removal regex

Command Injection Prevention

• packages/wdio-utils/src/node/utils.ts:
  • Replaced execSync with spawnSync for Chrome version detection
  • Replaced execSync with spawnSync for Firefox version detection
• infra/compiler/src/plugins.ts: Converted TypeScript compilation from shell command to direct process execution

Prototype Pollution Protection

• packages/wdio-browserstack-service/src/util.ts: Added key validation in mergeDeep() to prevent __proto__, constructor, and prototype pollution

Directory Traversal Protection

• scripts/bidi/downloadSpec.ts: Implemented comprehensive zip entry path validation to prevent zip slip attacks

Enhanced Sanitization

• packages/wdio-browserstack-service/src/ai-handler.ts: Improved string escaping for JavaScript execution contexts
• packages/wdio-cucumber-framework/src/utils.ts: Enhanced regex escaping for Cucumber tag expressions
• packages/wdio-cli/src/constants.ts: Fixed hostname validation for LambdaTest domains
• packages/webdriver/src/utils.ts: Fixed hostname validation for SauceLabs domains
• packages/wdio-browserstack-service/src/util.ts: Fixed hostname validation for BrowserStack domains
• packages/wdio-mocha-framework/src/common.ts: Replaced regex with safer string methods for module path parsing

Character Range Fixes

• packages/webdriverio/src/utils/findStrategy.ts: Fixed regex character class [a-zA-z] to [a-zA-Z] to prevent unintended character matching

🧪 Security Testing

All fixes have been designed to:

• ✅ Maintain backward compatibility
• ✅ Preserve existing functionality
• ✅ Use fail-safe defaults when validation fails
• ✅ Provide clear error messages for debugging

🎯 Impact

These fixes address potential security vectors including:

• Denial of Service via regex complexity attacks
• Remote Code Execution via command injection
• Application logic tampering via prototype pollution
• File system access via directory traversal
• Data injection via incomplete sanitization

🔍 Validation Methods Used

• Static analysis tools (CodeQL)
• Manual code review
• Security pattern matching
• Input validation testing

No breaking changes - All modifications maintain API compatibility while significantly improving security posture.