selenium - 使用 Selenium 自动填写包含敏感信息的表单有多安全

Question

Selenium 通常用于测试。但是，如果有人决定使用它在网站上自动填写包含个人数据(用户名、密码、信用卡号)的表单，该怎么办？那有多安全？

我的意思是调用驱动程序对象并向其传递所有这些安全信息的实际部分。我们假设信息被安全存储，直到您将其传递给驾驶员为止。

我想知道这是否是聚合信用卡和银行账户的网站使用的方式，而不是 API 调用(在后端运行 headless 浏览器来登录个人资料)。

Answer 1

使用Selenium时如 Security 中所述WebDriver - W3C Recommendation 内的部分唯一的安全问题是:

A user agent that rely on a command-line flag or a configuration option to test whether to enable WebDriver, or alternatively make the user agent initiate or confirm the connection through a privileged content document or control widget, in case the user agent does not directly implement the HTTP endpoints.

It is strongly suggested that user agents require users to take explicit action to enable WebDriver, and that WebDriver remains disabled in publicly consumed versions of the user agent.

To prevent arbitrary machines on the network from connecting and creating sessions, it is suggested that only connections from loopback devices are allowed by default.

The remote end can include a configuration option to limit the accepted IP range allowed to connect and make requests. The default setting for this might be to limit connections to the IPv4 localhost CIDR range 127.0.0.0/8 and the IPv6 localhost address ::1.

通用解决方案是将WebDriver控制下的用户代理 session 与用于正常浏览 session 的用户代理 session 区分开来。视觉上可区分的 WebDriver 驱动的用户代理的快照: