How do I protect the ports that chromedriver use?

Question

Normally when I run chromedriver I always get this output which I\'m sure everyone gets when running chromedriver. It\'s not the whole output but a

Answer 1

This INFO message...

Please protect ports used by ChromeDriver and related test frameworks to prevent access by malicious code.

... was the result of a bug which got induced with ChromeDriver v2.46

---

Analysis

As per the discussion 2.46 produces unexpected debug.log file if verbose logging is enabled, within the InitLogging() function of logging.cc some logging messages were written too early even before logging::InitLogging is called (at the last line of the function). This turned out to be OK on Linux and Mac OS, where the default log destination is where it is expected. But on Windows, the default log destination is a file named debug.log.

So ChromeDriver team needed to remove the two VLOG calls to the end of the method, after calling logging::InitLogging.

This issue was addressed through a commit and the fix was available within ChromeDriver 73.x

Protecting the ports that chromedriver use

There is nothing much we can do about the port usage as @barancev mentions ChromeDriver attempts to find a free Ephemeral port using a system-dependent ephemeral port range detector. An ephemeral port is a short-lived endpoint that is created by the operating system when a program requests any available user port. The operating system selects the port number from a predefined range, typically between 1024 and 65535, and releases the port after the related TCP connection terminates.

By default, the system can create a maximum of approximately 4,000 ephemeral ports that run concurrently on Windows Server 2003 and approximately 16,000 on Windows Server 2008.

---

Solution

Upgrading to ChromeDriver 73.x will solve this issue.

---

Outro

These log messages were the reflection of ChromeDriver - Security Considerations.

ChromeDriver is a powerful tool, and it can cause harms in the wrong hands. While using ChromeDriver, please follow these suggestions to help keeping it safe:

• By default, ChromeDriver only allows local connections. If you need to connect to it from a remote host, use --whitelisted-ips switch on the command line to specify a list of IP addresses that are allowed to connect to ChromeDriver.
• If possible, run ChromeDriver with a test account that has no access to sensitive local or network data. ChromeDriver should never be run with a privileged account.
• If possible, run ChromeDriver in a protected environment such as Docker or virtual machine.
• Use firewall to prevent unauthorized remote connection to ChromeDriver.
• If you are using ChromeDriver through third-party tools such as Selenium Server, be sure to protect the network ports of those tools as well.
• Use the latest versions of ChromeDriver and Chrome.

You can find the list of restricted ports on Chrome here.