Unsafe default Chrome launch arguments

[francisbeaudoin]

Context
Is there any specific reasons behind launching the Chrome process with disable-web-security?

ferrum/lib/ferrum/browser/options/chrome.rb

Line 12 in 19767d0

"disable-web-security" => nil,

This flag is at least disabling the same-origin policy hence having security implications if the browser is navigating to arbitrary websites.

Suggestion
Do not use the disable-web-security flag by default

[francisbeaudoin]

Hey @route 👋 I'm wondering if we could get this changed in the defaults?

[route]

I think it's useful for Cuprite and tests, so we could move it there and remove from Ferrum

[ldionmarcil]

Hi, +1 for this request. When ferrum is used to interact with untrusted user input (ie screenshot a website), --disable-web-security can lead to terrible side effects, like reading local files on the server.

ie, ferrum was tasked with taking a screenshot of https://site/page.html with the following contents:

<iframe src="file:///etc/passwd"></iframe>, then the contents of the file will be shown in the screenshot.

This should not be made possible for obvious reasons.