Enforce HTTP/1.1 for internal component JdkHttpClient (#2521)

Signed-off-by: Viet Nguyen Duc <[email protected]>

Author: VietND96

.github/workflows/build-ffmpeg.yml

@@ -4,6 +4,9 @@ on:
   push:
     paths:
       - '.ffmpeg/Dockerfile'
+  pull_request:
+    paths:
+      - '.ffmpeg/Dockerfile'
   workflow_dispatch:
     inputs:
       release:

Base/Dockerfile

@@ -130,6 +130,8 @@ RUN --mount=type=secret,id=SEL_PASSWD \
         org.seleniumhq.selenium:selenium-session-map-jdbc:${MVN_SELENIUM_VERSION} \
         org.postgresql:postgresql:${POSTGRESQL_VERSION} \
         org.seleniumhq.selenium:selenium-session-map-redis:${MVN_SELENIUM_VERSION} \
+        # Patch specific version for CVEs in the dependencies
+        io.lettuce:lettuce-core:6.5.1.RELEASE \
         > /external_jars/.classpath_session_map.txt \
         && chmod 664 /external_jars/.classpath_session_map.txt ; \
      fi \
@@ -185,6 +187,7 @@ ENV SE_BIND_HOST=false \
     SE_STRUCTURED_LOGS=false \
     SE_ENABLE_TRACING=true \
     SE_ENABLE_TLS=false \
+    SE_JAVA_HTTPCLIENT_VERSION="HTTP_1_1" \
     SE_JAVA_SSL_TRUST_STORE="/opt/selenium/secrets/server.jks" \
     SE_JAVA_SSL_TRUST_STORE_PASSWORD="/opt/selenium/secrets/server.pass" \
     SE_JAVA_DISABLE_HOSTNAME_VERIFICATION=true \

Distributor/start-selenium-grid-distributor.sh

@@ -179,6 +179,10 @@ else
   echo "Tracing is disabled"
 fi
 
+if [ -n "${SE_JAVA_HTTPCLIENT_VERSION}" ]; then
+  SE_JAVA_OPTS="$SE_JAVA_OPTS -Dwebdriver.httpclient.version=${SE_JAVA_HTTPCLIENT_VERSION}"
+fi
+
 java ${JAVA_OPTS:-$SE_JAVA_OPTS} \
   -jar /opt/selenium/selenium-server.jar \
   ${EXTRA_LIBS} \

EventBus/start-selenium-grid-eventbus.sh

@@ -109,6 +109,10 @@ else
   echo "Tracing is disabled"
 fi
 
+if [ -n "${SE_JAVA_HTTPCLIENT_VERSION}" ]; then
+  SE_JAVA_OPTS="$SE_JAVA_OPTS -Dwebdriver.httpclient.version=${SE_JAVA_HTTPCLIENT_VERSION}"
+fi
+
 java ${JAVA_OPTS:-$SE_JAVA_OPTS} \
   -jar /opt/selenium/selenium-server.jar \
   ${EXTRA_LIBS} event-bus \

Hub/start-selenium-grid-hub.sh

@@ -159,6 +159,10 @@ else
   echo "Tracing is disabled"
 fi
 
+if [ -n "${SE_JAVA_HTTPCLIENT_VERSION}" ]; then
+  SE_JAVA_OPTS="$SE_JAVA_OPTS -Dwebdriver.httpclient.version=${SE_JAVA_HTTPCLIENT_VERSION}"
+fi
+
 java ${JAVA_OPTS:-$SE_JAVA_OPTS} \
   -jar /opt/selenium/selenium-server.jar \
   ${EXTRA_LIBS} \

NodeBase/start-selenium-node.sh

@@ -171,6 +171,10 @@ CHROME_DRIVER_PATH_PROPERTY=-Dwebdriver.chrome.driver=/usr/bin/chromedriver
 EDGE_DRIVER_PATH_PROPERTY=-Dwebdriver.edge.driver=/usr/bin/msedgedriver
 GECKO_DRIVER_PATH_PROPERTY=-Dwebdriver.gecko.driver=/usr/bin/geckodriver
 
+if [ -n "${SE_JAVA_HTTPCLIENT_VERSION}" ]; then
+  SE_JAVA_OPTS="$SE_JAVA_OPTS -Dwebdriver.httpclient.version=${SE_JAVA_HTTPCLIENT_VERSION}"
+fi
+
 java ${JAVA_OPTS:-$SE_JAVA_OPTS} \
   ${CHROME_DRIVER_PATH_PROPERTY} \
   ${EDGE_DRIVER_PATH_PROPERTY} \

NodeDocker/start-selenium-grid-docker.sh

@@ -119,6 +119,10 @@ else
   echo "Tracing is disabled"
 fi
 
+if [ -n "${SE_JAVA_HTTPCLIENT_VERSION}" ]; then
+  SE_JAVA_OPTS="$SE_JAVA_OPTS -Dwebdriver.httpclient.version=${SE_JAVA_HTTPCLIENT_VERSION}"
+fi
+
 java ${JAVA_OPTS:-$SE_JAVA_OPTS} \
   -jar /opt/selenium/selenium-server.jar \
   ${EXTRA_LIBS} node \

NodeFirefox/Dockerfile

@@ -58,6 +58,9 @@ RUN apt-get update -qqy && \
   fi \
   # Download the language pack for Firefox
   && /opt/bin/get_lang_package.sh \
+  # Do one more upgrade to fix possible CVEs from Firefox dependencies
+  && apt-get update -qqy \
+  && apt-get upgrade -yq \
   && rm -rf /var/lib/apt/lists/* /var/cache/apt/*
 
 #============

Router/start-selenium-grid-router.sh

@@ -160,6 +160,10 @@ else
   echo "Tracing is disabled"
 fi
 
+if [ -n "${SE_JAVA_HTTPCLIENT_VERSION}" ]; then
+  SE_JAVA_OPTS="$SE_JAVA_OPTS -Dwebdriver.httpclient.version=${SE_JAVA_HTTPCLIENT_VERSION}"
+fi
+
 java ${JAVA_OPTS:-$SE_JAVA_OPTS} \
   -jar /opt/selenium/selenium-server.jar \
   ${EXTRA_LIBS} router \

SessionQueue/start-selenium-grid-session-queue.sh

@@ -113,6 +113,10 @@ else
   echo "Tracing is disabled"
 fi
 
+if [ -n "${SE_JAVA_HTTPCLIENT_VERSION}" ]; then
+  SE_JAVA_OPTS="$SE_JAVA_OPTS -Dwebdriver.httpclient.version=${SE_JAVA_HTTPCLIENT_VERSION}"
+fi
+
 java ${JAVA_OPTS:-$SE_JAVA_OPTS} \
   -jar /opt/selenium/selenium-server.jar \
   ${EXTRA_LIBS} sessionqueue \