Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

angular/protractor

              master @ 4bc80d1
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Improper Certificate Validation: 1 prior fix. Scrutinize any change in this area.

bin/webdriver-manager: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Improper Certificate Validation: The driver downloader failed to enforce TLS/SSL certificate verification, exposing installations to potential Man-in-the-Middle (MitM) attacks during binary updates. Developers must ensure 'rejectUnauthorized' remains enabled across all file downloaders.

Information Disclosure: Sauce Labs API credentials and passwords contained within Selenium URLs were printed directly to standard output via util.puts. Developers should ensure any driver provider logs enforce aggressive URL masking policies to strip authentication parameters.

Prototype Pollution: The use of the deprecated 'optimist' library for CLI argument parsing allowed arbitrary object prototype pollution. Ensuring that modern parsers are configured with object prototype protection is vital when handling raw user inputs.