Do not print secrets such as registration secret and router password to console on selenium grid hub and router startup

[frudisch]

User description

Description

When using the start-selenium-grid-hub.sh or start-selenium-grid-router.sh script the router password and registration secret got printed to the console. For testing usage this is (semi) fine. But when using Selenium Docker Images in a production environment, printing secrets to the console is a security issue. Therefore, all secrets printed to the console are replaced with '***' in this change.

Motivation and Context

• Use docker-selenium in production environment without security concerns

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist

• I have read the contributing document.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• All new and existing tests passed.

---

PR Type

Bug fix

---

Description

• Masked sensitive information such as SE_REGISTRATION_SECRET and SE_ROUTER_PASSWORD in console output for both Selenium Grid Hub and Router startup scripts.
• Enhances security by preventing sensitive data from being exposed in production environments.

---

Changes walkthrough 📝

Relevant files

Bug fix

start-selenium-grid-hub.sh Mask sensitive information in console output for Hub          Hub/start-selenium-grid-hub.sh Masked the SE_REGISTRATION_SECRET when printing to console. Masked the SE_ROUTER_PASSWORD when printing to console. +2/-2      start-selenium-grid-router.sh Mask sensitive information in console output for Router    Router/start-selenium-grid-router.sh Masked the SE_REGISTRATION_SECRET when printing to console. Masked the SE_ROUTER_PASSWORD when printing to console. +2/-2

---

💡 PR-Agent usage:
Comment /help on the PR to get a list of all available PR-Agent tools and their descriptions

[CLAassistant]

All committers have signed the CLA.

[qodo-merge-pro]

PR Reviewer Guide 🔍

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🧪 No relevant tests

🔒 Security concerns No security concerns. In fact, this PR addresses a security issue by masking sensitive information in console output. The changes prevent the exposure of SE_REGISTRATION_SECRET and SE_ROUTER_PASSWORD by replacing them with '***' in the console logs. This is a good security practice, especially for production environments.

⚡ No key issues to review

[qodo-merge-pro]

PR Code Suggestions ✨

Category	Suggestion	Score
Security	Use a dynamic method to mask sensitive information in log messages Consider using a more secure method to mask sensitive information. Instead of hardcoding '', you could use a variable or a function to generate a mask of appropriate length.* Hub/start-selenium-grid-hub.sh [73] -echo "Appending Selenium options: --registration-secret ***" +echo "Appending Selenium options: --registration-secret ${SE_REGISTRATION_SECRET//?/*}" Apply this suggestion Suggestion importance[1-10]: 8 Why: The suggestion improves security by dynamically masking the registration secret, which is a better practice than hardcoding a static mask. This change enhances the security of sensitive information in logs.	8
	Use a dynamic method to mask sensitive information in router log messages Similar to the hub script, consider using a dynamic method to mask the registration secret instead of hardcoding ''.* Router/start-selenium-grid-router.sh [105] -echo "Appending Selenium options: --registration-secret ***" +echo "Appending Selenium options: --registration-secret ${SE_REGISTRATION_SECRET//?/*}" Apply this suggestion Suggestion importance[1-10]: 8 Why: Similar to the hub script, this suggestion enhances security by dynamically masking the registration secret, preventing exposure of sensitive information in logs.	8
Best practice	Apply consistent masking to all potentially sensitive information in log messages For consistency, consider applying the same masking technique to the username as well. This ensures all potentially sensitive information is treated equally. Hub/start-selenium-grid-hub.sh [83] -echo "Appending Selenium options: --username ${SE_ROUTER_USERNAME}" +echo "Appending Selenium options: --username ${SE_ROUTER_USERNAME//?/*}" Apply this suggestion Suggestion importance[1-10]: 7 Why: While the username is not as sensitive as passwords or secrets, applying consistent masking improves the uniformity and security of log messages. This is a good practice for maintaining consistency.	7
	Apply consistent masking to all potentially sensitive information across different scripts For consistency across both hub and router scripts, consider masking the username in the router script as well. Router/start-selenium-grid-router.sh [115] -echo "Appending Selenium options: --username ${SE_ROUTER_USERNAME}" +echo "Appending Selenium options: --username ${SE_ROUTER_USERNAME//?/*}" Apply this suggestion Suggestion importance[1-10]: 7 Why: Consistent masking of the username across scripts improves uniformity and treats all potentially sensitive information equally, which is a best practice for maintaining security and consistency.	7

[VietND96]

Thank you, @frudisch
I am going to add something further on this before merging to trunk