Is it security vulnerability to disable the W3C when initializing the webdriver in cucumber - webdriver

Because of web driver in compatibility and issue is calling non w3 standard command, w3c option is set to false in cucumber environment configuration.
Capybara.register_driver :chrome do |app|
capabilities = Selenium::WebDriver::Remote::Capabilities.chrome(
chromeOptions: {'w3c' => false}
)
Capybara::Selenium::Driver.new(app, :browser => :chrome,
desired_capabilities: capabilities)
end
Does this causes any security problems ?

There is no security issue with turning off W3C mode. Google is supporting both W3C mode and the legacy mode at the moment, although legacy will go away at some point.

Related

How can I turn on the profiler in production mode (Symfony)?

I have a strange error. My Symfony app works fine in dev mode. But in production mode I am not able to save any files.
So I need to turn on the profiler in production mode for a second to see what is the error.
How can I achieve this?
Symfony profiler shouldn’t be in prod mode. Symfony docs : "Never enable the profiler in production environments as it will lead to major security vulnerabilities in your project."
You need to focus on your logs server. But if you want to do this.
Create a web_profiler.yaml (.../config/packages/prod)
Insert this content :
web_profiler:
toolbar: true
intercept_redirects: false
framework:
profiler: { only_exceptions: false }
Remove this after your found your problem
Regards

Can we use IndexedDB storage client-side in ASP.NET application?

I have got the error saying "Microsoft JScript runtime error: Object doesn't support property or method 'addEventListener' ", when I try to write the IndexedDB codings in my .aspx files.. Will the .aspx pages accept IndexedDB concepts or not??.. If not, then how can I store my SQL server to my local browser?
IDB is fully supported in IE10 and IE11, the latest versions of IE.
Are you perhaps in an IE10 environment? Because if you're in IE10, you can't use the addEventListener interface and should use the attachEvent method instead.

ASP.NET Bundling: Run IBundleTransform even when not optimizing

We're using System.Web.Optimization bundling to bundle & compress our JS and CSS.
We also use a custom IBundleTransform implementation in addition to to the existing JsMinify and CssMinify to do some fancy stuff to the JS (replacement of certain placeholders) before sending it to the browser.
Everything works fine as long as we're running in Release mode, because then the bundling and optimizing kicks in. But in Debug mode (which is nice for debugging ;) it seems to completely ignore all the specified IBundleTransform (makes sense in most use-cases, I guess).
Is there any way to always run our own IBundleTransform, even in Debug mode, but run the other (default) bundling algorithms (JsMinify, CssMinify) only when I really want to optimize (in Release mode)?
So the debug/release magic is controlled via the Scripts/Styles helpers. The behavior to not apply any transforms is baked into the implementation of these helpers, so if you want to do this, the best workaround might just be to have a debug/release version of each bundle and always enable bundling via BundleTable.EnableOptimizations = true.
if (!HttpContext.Current.IsDebuggingEnabled)
BundleTable.EnableOptimizations = true;

ASP.NET disable "C:\fakepath" in FileUpload control

ASP.NET 4.0
I've checked that using both or control (which is a wrap of html file input) will display "C:\fakepath\MyFile" in both Google Chrome 12.0 and IE8.0 on my Windows 7. It only displays "MyFile" in FF3.6. I am trying to not display "C:\fakepath\" string since it's not usual to most users.
I already enabled displaying full path in IE security setting which mentioned in another SO thread, so that shouldn't be just an IE security issue. Not to mention GC is showing fakepath too.
I am more suspecting it's because of my compilation environment -- Windows 7 + VS2010 SP1 + MVC3 installed. Can the community tell me how to disable this?
It can't be disabled, it's a browser security feature. It ensures the server doesn't have access to any file information on the client. Some browsers handle it differently, which is why in FF you just see the file name.
See this related question:
Javascript loading clients local media

Detect from browser if specific application is installed

We have an advanced webpage (ASP.NET, C#), and a application which needs to be installed on the client computer in order to utilize the webpage to its fullest. The application is a tray app, and has primarily two tasks. Detect when certain events happen on the webserver (for instance invited to a meeting, or notify of an upcoming meeting). The other task the trayapp has is to use a custom protocol (trayapp://) to perform some ajax calls back to the server.
One problem we have is how to determine if the application is installed on the local machine or not. Now the user has to tick a checkbox to inform the website that the application is installed, and that it's safe to call the trayapp:// url calls.
Is there any way, for instance through a JavaScript or similar to detect if our application is installed on the local machine?
The check needs to work for IE, FF and Opera browsers.
When installing your client-side app you could modify the browser configuration to include another request header in HTTP requests and then have the server code look for that header, for example as a supported mime type using the following registry key (for Internet explorer)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
Internet Settings\Accepted Documents
I am not sure if Opera and FF use this same key, but they likely have similar configuration options, but this should at least get you on the right track.
If you want to detect with javascript inside the browser, you can probably use the collection "navigator.plugins". It works with Firefox, Opera and Chrome but unfortunately not with IE.
Update:
In FF, Opera and Chrome you can test it easily like this:
if (navigator.plugins["Adobe Acrobat"]) {
// do some stuff if it is installed
} else {
// do some other stuff if its not installed
}
Update #2:
If it is an ActiveX object in IE you can test if it exists by using something like this:
function getActiveXObject(name){
try{
return new ActiveXObject(name);
}
catch(err){
return undefined;
}
};
Another approach for IE is something similar to what JohnFx suggested (I found it here and have not tested it):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Internet
Settings\User Agent\Post Platform
Good idea from #JohnFx.
Another way to tackle this would be to install an ActiveX control or Browser plug-in with the trayapp installation. You could then access this in a similar way to that done when checking the version of Flash available.
Expose the trayapp (assuming this as a Managed app) as COM object. You could then use the tag with the GUID and trap errors when not found or use the ActiveXobject with the progid to detect if it's installed.

Resources