LTS-5442: harden selenium sample (Semgrep pin, jest lockfile, web-security flag, credential + CLI-verify guidance)

.github/workflows/Semgrep.yml

@@ -27,7 +27,7 @@ jobs:
 
     container:
       # A Docker image with Semgrep installed. Do not change this.
-      image: returntocorp/semgrep:1.166.0
+      image: returntocorp/semgrep:1.166.0@sha256:c180f0c93a17b420c0af5006214a29d3c747c5459c732b740191adf657dd0068
     # Skip any PR created by dependabot to avoid permission issues:
     if: (github.actor != 'dependabot[bot]')
 

.gitignore

@@ -3,6 +3,5 @@
 **/browserstack-cli
 **/.DS_Store
 **/node_modules/
-**/package-lock.json
 **/yarn.lock
 **/pnpm-lock.yaml

README.md

@@ -40,20 +40,38 @@
      [browserstack-cli-windows](https://load-api.browserstack.com/api/v1/binary?os=win&arch=x64)
 
    - **Linux x86**  
-     [browserstack-cli-linux-x86](https://load-api.browserstack.com/api/v1/binary?os=linux&arch=arm64)
+     [browserstack-cli-linux-x86](https://load-api.browserstack.com/api/v1/binary?os=linux&arch=x64)
 
    - **Linux ARM**  
-     [browserstack-cli-linux-arm](https://load-api.browserstack.com/api/v1/binary?os=linux&arch=x64)
+     [browserstack-cli-linux-arm](https://load-api.browserstack.com/api/v1/binary?os=linux&arch=arm64)
 
-   > Place the downloaded `browserstack-cli` binary in the root of your project.
+   > The download is a zip. Extract it and place the `browserstack-cli` binary in the root of your project.
 
-5. **Run tests using BrowserStack CLI**
+5. **Verify the BrowserStack CLI**
+
+   Before running the binary, check that it is signed by BrowserStack:
+
+   - **macOS**: the output must include `TeamIdentifier=YQ5FZQ855D` (Browserstack Inc).
+
+     ```sh
+     codesign --verify --strict ./browserstack-cli && codesign -dv ./browserstack-cli 2>&1 | grep TeamIdentifier
+     ```
+
+   - **Windows** (PowerShell): `Status` must be `Valid` and the signer must be BrowserStack.
+
+     ```powershell
+     Get-AuthenticodeSignature .\browserstack-cli.exe | Format-List Status, SignerCertificate
+     ```
+
+   If the check fails, do not run the binary.
+
+6. **Run tests using BrowserStack CLI**
 
    ```sh
    ./browserstack-cli load run
    ```
 
-6. **View Test Results**
+7. **View Test Results**
 
    Visit the [BrowserStack Load-Testing Dashboard](https://load.browserstack.com/projects) to monitor and analyze your test runs.
 

java/README.md

@@ -39,15 +39,33 @@
    - **Linux ARM**  
      [browserstack-cli-linux-arm](https://load-api.browserstack.com/api/v1/binary?os=linux&arch=arm64)
 
-   > Place the downloaded `browserstack-cli` binary in the root of your project.
+   > The download is a zip. Extract it and place the `browserstack-cli` binary in the root of your project.
 
-4. **Run tests using BrowserStack CLI**
+4. **Verify the BrowserStack CLI**
+
+   Before running the binary, check that it is signed by BrowserStack:
+
+   - **macOS**: the output must include `TeamIdentifier=YQ5FZQ855D` (Browserstack Inc).
+
+     ```sh
+     codesign --verify --strict ./browserstack-cli && codesign -dv ./browserstack-cli 2>&1 | grep TeamIdentifier
+     ```
+
+   - **Windows** (PowerShell): `Status` must be `Valid` and the signer must be BrowserStack.
+
+     ```powershell
+     Get-AuthenticodeSignature .\browserstack-cli.exe | Format-List Status, SignerCertificate
+     ```
+
+   If the check fails, do not run the binary.
+
+5. **Run tests using BrowserStack CLI**
 
    ```sh
    ./browserstack-cli load run
    ```
 
-5. **View Test Results**
+6. **View Test Results**
 
    Visit the [BrowserStack Load-Testing Dashboard](https://load.browserstack.com/projects) to monitor and analyze your test runs.
 

java/browserstack-load.yml

@@ -1,7 +1,8 @@
 # =============================
 # Set BrowserStack Credentials
 # =============================
-# Add your BrowserStack userName and accessKey here or set BROWSERSTACK_USERNAME and BROWSERSTACK_ACCESS_KEY as env variables.
+# Set BROWSERSTACK_USERNAME and BROWSERSTACK_ACCESS_KEY as env variables. They override the placeholders below.
+# Do not paste your real access key into this file: it is easy to commit and push by mistake.
 userName: BROWSERSTACK_USERNAME
 accessKey: BROWSERSTACK_ACCESS_KEY
 

java/src/test/java/com/example/SimpleTest.java

@@ -65,7 +65,6 @@ private WebDriver createDriver() throws Exception {
           "--disable-renderer-backgrounding",
           "--disable-features=TranslateUI",
           "--disable-ipc-flooding-protection",
-          "--disable-web-security",
           "--disable-features=VizDisplayCompositor",
           "--disable-logging",
           "--silent"

jest/README.md

@@ -34,20 +34,38 @@
      [browserstack-cli-windows](https://load-api.browserstack.com/api/v1/binary?os=win&arch=x64)
 
    - **Linux x86**  
-     [browserstack-cli-linux-x86](https://load-api.browserstack.com/api/v1/binary?os=linux&arch=arm64)
+     [browserstack-cli-linux-x86](https://load-api.browserstack.com/api/v1/binary?os=linux&arch=x64)
 
    - **Linux ARM**  
-     [browserstack-cli-linux-arm](https://load-api.browserstack.com/api/v1/binary?os=linux&arch=x64)
+     [browserstack-cli-linux-arm](https://load-api.browserstack.com/api/v1/binary?os=linux&arch=arm64)
 
-   > Place the downloaded `browserstack-cli` binary in the root of your project.
+   > The download is a zip. Extract it and place the `browserstack-cli` binary in the root of your project.
 
-4. **Run tests using BrowserStack CLI**
+4. **Verify the BrowserStack CLI**
+
+   Before running the binary, check that it is signed by BrowserStack:
+
+   - **macOS**: the output must include `TeamIdentifier=YQ5FZQ855D` (Browserstack Inc).
+
+     ```sh
+     codesign --verify --strict ./browserstack-cli && codesign -dv ./browserstack-cli 2>&1 | grep TeamIdentifier
+     ```
+
+   - **Windows** (PowerShell): `Status` must be `Valid` and the signer must be BrowserStack.
+
+     ```powershell
+     Get-AuthenticodeSignature .\browserstack-cli.exe | Format-List Status, SignerCertificate
+     ```
+
+   If the check fails, do not run the binary.
+
+5. **Run tests using BrowserStack CLI**
 
    ```sh
    ./browserstack-cli load run
    ```
 
-5. **View Test Results**
+6. **View Test Results**
 
    Visit the [BrowserStack Load-Testing Dashboard](https://load.browserstack.com/projects) to monitor and analyze your test runs.
 

jest/browserstack-load.yml

@@ -1,7 +1,8 @@
 # =============================
 # Set BrowserStack Credentials
 # =============================
-# Add your BrowserStack userName and accessKey here or set BROWSERSTACK_USERNAME and BROWSERSTACK_ACCESS_KEY as env variables.
+# Set BROWSERSTACK_USERNAME and BROWSERSTACK_ACCESS_KEY as env variables. They override the placeholders below.
+# Do not paste your real access key into this file: it is easy to commit and push by mistake.
 userName: BROWSERSTACK_USERNAME
 accessKey: BROWSERSTACK_ACCESS_KEY