1753997 - Enable WebDriver BiDi on release channels

Status: RESOLVED FIXED

(Remote Protocol :: WebDriver BiDi, enhancement, P2)

Description

[Henrik Skupin [:whimboo][⌚️UTC+2] (away 10/03 - 10/13)]

Right now the WebDriver BiDi protocol as handled by the Remote Agent is only enabled for Nightly and pref'ed off on release channels:

https://searchfox.org/mozilla-central/rev/072f9e6b7f10a00e12d0a02ac713431d0a7ee368/modules/libpref/init/all.js#4455-4463

Over the last half year we've made good progress on the project and implemented the framework and on-top the first commands and events. Any code addition and change is covered by the wdspec tests.

Given that we would like to enable the WebDriver BiDi protocol on release channels. At the same time this is also required in our current Milestone 3 to get Selenium support added (bug 1753991). Their requirement is to have the protocol officially enabled in such builds.

Freddy, is there a need for an additional security review here? The WebDriver BiDi protocol uses like CDP the Remote Agent's code base including the handling of WebSockets for clients to connect, and all is enabled on release for quite some time. The only difference here is the protocol implementation, means handling of command and events.

Comment 1

[Frederik Braun [:freddy]]

Redirecting to Dan, who's taking care of security reviews. Happy to join the session though.

Comment 2

[Henrik Skupin [:whimboo][⌚️UTC+2] (away 10/03 - 10/13)]

Dan, if you could find the time to send us the final email covering all the aspects of the security review meeting that would be kinda appreciated! Thanks a lot.

Comment 3

[Henrik Skupin [:whimboo][⌚️UTC+2] (away 10/03 - 10/13)]

Beside getting bug 1719505 fixed, there is only a single item left to do before we can enable the WebDriver Bidi protocol on release channels. And this is related to our documentation, which should clearly express that the used WebSocket connections aren't using TLS and as such the payload of packages can be observed. We will do this update together with necessary patches to enable BiDi on beta and release.

Comment 4

[Julian Descottes [:jdescottes]]

Attachment: Bug 1753997 - [remote] Enable WebDriver BiDi on all channels

Comment 5

[Julian Descottes [:jdescottes]]

Attachment: Bug 1753997 - [wdspec] Enable all BiDi wdspec tests on beta and release channels

Depends on D144846

Comment 6

[Julian Descottes [:jdescottes]]

Attachment: Bug 1753997 - [remote] Add security warning for custom hosts/origins in RemoteAgent helptext

Depends on D144847

Comment 7

[Julian Descottes [:jdescottes]]

Attachment: Bug 1753997 - [remote] Add documentation about remote hosts and origins for RemoteAgent

Depends on D144850

Comment 8

[Julian Descottes [:jdescottes]]

I put all the patches to enable WebDriver BiDi on release in changes planned given we're still waiting for Bug 1719505 before we can land that.

But for now the changes include:

• flip the preference + update a related mention in the docs
• enable all wdspec tests on release & beta
• update infoText for the remote-allow-* command line arguments
• update the documentation at https://firefox-source-docs.mozilla.org/remote/Security.html

If there's something else to take into account here, let me know.

Comment 9

[Julian Descottes [:jdescottes]]

Although it should be safe to land, the last dependency landed really close to merge day.
I prefer to wait after merge day to land and ask for an uplift afterwards.

Comment 10

[Julian Descottes [:jdescottes]]

Started two beta-simulations:

• preset remote-protocol: https://treeherder.mozilla.org/jobs?repo=try&revision=ef8f77ca9c8a59691e2086f80dfcbb419b725e91
• all jobs https://treeherder.mozilla.org/jobs?repo=try&revision=86f8861d2a00824061e163183468fbb5c857ed98

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/92db533a91b5
[remote] Enable WebDriver BiDi on all channels r=webdriver-reviewers,whimboo
https://hg.mozilla.org/integration/autoland/rev/c16a2b89b66a
[wdspec] Enable all BiDi wdspec tests on beta and release channels r=webdriver-reviewers,whimboo
https://hg.mozilla.org/integration/autoland/rev/b822baacbb16
[remote] Add documentation about remote hosts and origins for RemoteAgent r=webdriver-reviewers,jgraham

Comment 12

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/92db533a91b5
https://hg.mozilla.org/mozilla-central/rev/c16a2b89b66a
https://hg.mozilla.org/mozilla-central/rev/b822baacbb16

Comment 13

[Henrik Skupin [:whimboo][⌚️UTC+2] (away 10/03 - 10/13)]

As discussed we should wait with any uplift request until the regression bug 1767387 has been fixed.

Comment 14

[Julian Descottes [:jdescottes]]

Comment on attachment 9274080 [details]
Bug 1753997 - [remote] Enable WebDriver BiDi on all channels

Beta/Release Uplift Approval Request

• User impact if declined: Selenium would like to start using WebDriver BiDi for Firefox to give access to console logs. Since they rely on the release channel, we want to enable WebDriver BiDi on the release channel to avoid blocking them here. Otherwise they would have to fallback to our partial CDP implementation which we want to phase out.

We should also uplift the followup Bug 1767387, which contains improvements to the initialization of WebDriver BiDi.
Bug 1753997 should be uplifted first and Bug 1767387 second to avoid conflicts.

The patches seem to rebase fine on the current beta (pushed to try at https://treeherder.mozilla.org/jobs?repo=try&revision=b58d5720792e6c6e8db94917f3fde19e1aa53948 for reference)

• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: Bug 1767387
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): The patches in bug 1753997 are mostly configuration change. We are updating the preference remote.active-protocols to have the same value on all channels (now set to 3 everywhere). This effectively means that the WebDriver BiDi protocol will be started when --remote-debugging-port is passed to Firefox. We are also updating the manifests for all the related tests to make sure they also run on beta and release, as well as the documentation.

Bug 1767387 improves the stability of the startup of Remote Agent by making sure to use events available on all platforms. While this is more impactful than the patches on Bug 1753997, we are mostly moving the startup of the remote protocol during the initialization of the browser.

All the relevant code is heavily tested via xpcshell tests, browser mochitests and wdspec tests.

Most importantly, those patches only impact users passing --remote-debugging-port to start Firefox and should have no effect for regular users.

• String changes made/needed:
• Is Android affected?: Yes

Comment 15

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9274080 [details]
Bug 1753997 - [remote] Enable WebDriver BiDi on all channels

Approved for 101.0b3.

Comment 16

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/6d5c82f2064f
https://hg.mozilla.org/releases/mozilla-beta/rev/231751a9ce08
https://hg.mozilla.org/releases/mozilla-beta/rev/6c6ea44fcc96

Comment 17

[Jan Honza Odvarko [:Honza] (always need-info? me)]

WebDriver BiDi was enabled on all channels in Firefox 101 (see also spec for more details about the protocol [1]). Thanks to this, third party tools such as Selenium will now be able to use WebDriver BiDi to control / interact with Firefox.

[1] https://w3c.github.io/webdriver-bidi/

Comment 18

[Ryan VanderMeulen [:RyanVM]]

Added to the final Fx101 relnotes.