Skip to content

Conversation

@aguspe
Copy link
Contributor

@aguspe aguspe commented Dec 14, 2025

User description

🔗 Related Issues

Fixes #16703

💥 What does this PR do?

This PR adds a helper method to enforce encoding in http/common

🔧 Implementation Notes

I implement it this way in order to try to catch all the values before they are passed to JSON

🔄 Types of changes

  • Bug fix (backwards compatible)

PR Type

Bug fix


Description

  • Adds UTF-8 encoding enforcement to prevent JSON 3.0 compatibility warnings

  • Recursively converts binary-encoded strings in command hashes before JSON serialization

  • Handles nested structures (hashes and arrays) with proper encoding validation

  • Raises descriptive errors for invalid byte sequences that cannot be encoded


Diagram Walkthrough

flowchart LR
  A["Command Hash"] -->|ensure_utf8_encoding| B["Recursive Processing"]
  B -->|String| C["encode_string_to_utf8"]
  B -->|Array| D["Map Items"]
  B -->|Hash| E["Transform Keys/Values"]
  C -->|Binary/ASCII_8BIT| F["force_encoding to UTF-8"]
  C -->|Other| G["encode to UTF-8"]
  F --> H["Valid Encoding?"]
  H -->|Yes| I["Return UTF-8 String"]
  H -->|No| J["encode to UTF-8"]
  J --> K["JSON.generate"]
  G --> K
  I --> K
Loading

File Walkthrough

Relevant files
Bug fix
common.rb
Add UTF-8 encoding conversion for JSON compatibility         

rb/lib/selenium/webdriver/remote/http/common.rb

  • Added BINARY_ENCODINGS constant to identify binary-encoded strings
  • Introduced ensure_utf8_encoding method to recursively process command
    hashes
  • Implemented encode_string_to_utf8 helper to convert strings with
    proper validation
  • Integrated encoding conversion before JSON serialization in the call
    method
+32/-0   
Tests
common_spec.rb
Add encoding conversion test coverage                                       

rb/spec/unit/selenium/webdriver/remote/http/common_spec.rb

  • Added comprehensive test suite for UTF-8 encoding conversion
  • Tests cover binary-encoded strings, nested hashes, and arrays
  • Validates error handling for invalid byte sequences
  • Verifies already UTF-8 encoded strings pass through unchanged
+69/-0   

@selenium-ci selenium-ci added the C-rb Ruby Bindings label Dec 14, 2025
@qodo-code-review
Copy link
Contributor

qodo-code-review bot commented Dec 14, 2025

PR Compliance Guide 🔍

Below is a summary of compliance checks for this PR:

Security Compliance
🟢
No security concerns identified No security vulnerabilities detected by AI analysis. Human verification advised for critical code.
Ticket Compliance
🎫 No ticket provided
  • Create ticket/issue
Codebase Duplication Compliance
Codebase context is not defined

Follow the guide to enable codebase context checks.

Custom Compliance
🟢
Generic: Meaningful Naming and Self-Documenting Code

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Robust Error Handling and Edge Case Management

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Security-First Input Validation and Data Handling

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

🔴
Generic: Secure Error Handling

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status:
Sensitive error data: The raised error message includes the string’s inspected content and original encoding,
which may leak sensitive data to end users of this exception path.

Referred Code
  str.encode(Encoding::UTF_8)
rescue Encoding::Error => e
  raise Error::WebDriverError,
        "Unable to encode string to UTF-8: #{e.message}. " \
        "String encoding: #{str.encoding}, content: #{str.inspect}"
end

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Comprehensive Audit Trails

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status:
No audit logs: The new encoding enforcement and JSON generation logic performs potentially critical
request mutations without emitting any audit logs of the action, actor, or outcome.

Referred Code
def call(verb, url, command_hash)
  url      = server_url.merge(url) unless url.is_a?(URI)
  headers  = common_headers.dup
  headers['Cache-Control'] = 'no-cache' if verb == :get

  if command_hash
    command_hash              = ensure_utf8_encoding(command_hash)
    payload                   = JSON.generate(command_hash)
    headers['Content-Length'] = payload.bytesize.to_s if %i[post put].include?(verb)

    WebDriver.logger.debug("   >>> #{url} | #{payload}", id: :command)

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Secure Logging Practices

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status:
Payload in logs: Debug logging emits the full JSON payload which could contain sensitive data, and there is
no visible redaction or filtering in this diff.

Referred Code
WebDriver.logger.debug("   >>> #{url} | #{payload}", id: :command)
WebDriver.logger.debug("     > #{headers.inspect}", id: :header)

Learn more about managing compliance generic rules or creating your own custom rules

  • Update
Compliance status legend 🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

@qodo-code-review
Copy link
Contributor

qodo-code-review bot commented Dec 14, 2025

PR Code Suggestions ✨

Explore these optional code suggestions:

CategorySuggestion                                                                                                                                    Impact
Possible issue
Handle symbol keys in hashes

In the ensure_utf8_encoding method, add a case to handle Symbol objects by
converting them to strings before encoding to prevent potential JSON
serialization errors.

rb/lib/selenium/webdriver/remote/http/common.rb [96-109]

 def ensure_utf8_encoding(obj)
   case obj
   when String
     encode_string_to_utf8(obj)
+  when Symbol
+    encode_string_to_utf8(obj.to_s)
   when Array
     obj.map { |item| ensure_utf8_encoding(item) }
   when Hash
     obj.each_with_object({}) do |(key, value), result|
       result[ensure_utf8_encoding(key)] = ensure_utf8_encoding(value)
     end
   else
     obj
   end
 end
  • Apply / Chat
Suggestion importance[1-10]: 7

__

Why: The suggestion correctly identifies that Symbol keys in hashes are not handled, which could lead to encoding errors during JSON serialization for non-ASCII symbols. Adding a case for Symbol makes the new encoding utility more robust and complete.

Medium
  • Update

@aguspe aguspe merged commit ea6f8e5 into SeleniumHQ:trunk Dec 15, 2025
22 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[🐛 Bug]: JSON encoding warning from Ruby Selenium::WebDriver::Remote::Http::Common

3 participants