diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..0100bb9 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,72 @@ +# Changelog + +All notable changes to this project will be documented in this file. + +The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), +and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). + +## [Unreleased] + +### Added +- CONTRIBUTING.md with contribution guidelines +- CHANGELOG.md for tracking version history +- CODE_OF_CONDUCT.md for community standards +- SECURITY.md with security policy and vulnerability reporting + +## [0.5.0] + +### Added +- I/O Mode with built-in WebSocket connection support via `cdp.connection` module +- WebSocket management with async context managers +- JSON-RPC message framing and multiplexing +- Event handling via async iterators +- Comprehensive error handling with typed exceptions +- Optional websockets dependency via `[io]` extra + +### Changed +- Enhanced README with I/O mode documentation +- Improved examples demonstrating both Sans-I/O and I/O modes + +## [0.4.0] + +### Changed +- Updated to latest Chrome DevTools Protocol specification +- Improved type hints and mypy compliance +- Enhanced documentation + +## [0.3.0] + +### Added +- Initial Sans-I/O implementation +- Automatic code generation from CDP specification +- Type wrappers for all CDP types, commands, and events +- Comprehensive test suite + +### Changed +- Improved project structure +- Enhanced type safety + +## [0.2.0] + +### Added +- Enhanced type definitions +- Additional protocol domains + +### Fixed +- Various type annotation improvements +- Bug fixes in code generation + +## [0.1.0] + +### Added +- Initial release +- Basic type wrappers for Chrome DevTools Protocol +- Code generator from CDP specification +- MIT License + +[Unreleased]: https://github.com/HyperionGray/python-chrome-devtools-protocol/compare/v0.5.0...HEAD +[0.5.0]: https://github.com/HyperionGray/python-chrome-devtools-protocol/compare/v0.4.0...v0.5.0 +[0.4.0]: https://github.com/HyperionGray/python-chrome-devtools-protocol/compare/v0.3.0...v0.4.0 +[0.3.0]: https://github.com/HyperionGray/python-chrome-devtools-protocol/compare/v0.2.0...v0.3.0 +[0.2.0]: https://github.com/HyperionGray/python-chrome-devtools-protocol/compare/v0.1.0...v0.2.0 +[0.1.0]: https://github.com/HyperionGray/python-chrome-devtools-protocol/releases/tag/v0.1.0 diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..6bf31a2 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,127 @@ +# Contributor Covenant Code of Conduct + +## Our Pledge + +We as members, contributors, and leaders pledge to make participation in our +community a harassment-free experience for everyone, regardless of age, body +size, visible or invisible disability, ethnicity, sex characteristics, gender +identity and expression, level of experience, education, socio-economic status, +nationality, personal appearance, race, religion, or sexual identity +and orientation. + +We pledge to act and interact in ways that contribute to an open, welcoming, +diverse, inclusive, and healthy community. + +## Our Standards + +Examples of behavior that contributes to a positive environment for our +community include: + +* Demonstrating empathy and kindness toward other people +* Being respectful of differing opinions, viewpoints, and experiences +* Giving and gracefully accepting constructive feedback +* Accepting responsibility and apologizing to those affected by our mistakes, + and learning from the experience +* Focusing on what is best not just for us as individuals, but for the + overall community + +Examples of unacceptable behavior include: + +* The use of sexualized language or imagery, and sexual attention or + advances of any kind +* Trolling, insulting or derogatory comments, and personal or political attacks +* Public or private harassment +* Publishing others' private information, such as a physical or email + address, without their explicit permission +* Other conduct which could reasonably be considered inappropriate in a + professional setting + +## Enforcement Responsibilities + +Community leaders are responsible for clarifying and enforcing our standards of +acceptable behavior and will take appropriate and fair corrective action in +response to any behavior that they deem inappropriate, threatening, offensive, +or harmful. + +Community leaders have the right and responsibility to remove, edit, or reject +comments, commits, code, wiki edits, issues, and other contributions that are +not aligned to this Code of Conduct, and will communicate reasons for moderation +decisions when appropriate. + +## Scope + +This Code of Conduct applies within all community spaces, and also applies when +an individual is officially representing the community in public spaces. +Examples of representing our community include using an official e-mail address, +posting via an official social media account, or acting as an appointed +representative at an online or offline event. + +## Enforcement + +Instances of abusive, harassing, or otherwise unacceptable behavior may be +reported to the community leaders responsible for enforcement via GitHub issues. +All complaints will be reviewed and investigated promptly and fairly. + +All community leaders are obligated to respect the privacy and security of the +reporter of any incident. + +## Enforcement Guidelines + +Community leaders will follow these Community Impact Guidelines in determining +the consequences for any action they deem in violation of this Code of Conduct: + +### 1. Correction + +**Community Impact**: Use of inappropriate language or other behavior deemed +unprofessional or unwelcome in the community. + +**Consequence**: A private, written warning from community leaders, providing +clarity around the nature of the violation and an explanation of why the +behavior was inappropriate. A public apology may be requested. + +### 2. Warning + +**Community Impact**: A violation through a single incident or series +of actions. + +**Consequence**: A warning with consequences for continued behavior. No +interaction with the people involved, including unsolicited interaction with +those enforcing the Code of Conduct, for a specified period of time. This +includes avoiding interactions in community spaces as well as external channels +like social media. Violating these terms may lead to a temporary or +permanent ban. + +### 3. Temporary Ban + +**Community Impact**: A serious violation of community standards, including +sustained inappropriate behavior. + +**Consequence**: A temporary ban from any sort of interaction or public +communication with the community for a specified period of time. No public or +private interaction with the people involved, including unsolicited interaction +with those enforcing the Code of Conduct, is allowed during this period. +Violating these terms may lead to a permanent ban. + +### 4. Permanent Ban + +**Community Impact**: Demonstrating a pattern of violation of community +standards, including sustained inappropriate behavior, harassment of an +individual, or aggression toward or disparagement of classes of individuals. + +**Consequence**: A permanent ban from any sort of public interaction within +the community. + +## Attribution + +This Code of Conduct is adapted from the [Contributor Covenant][homepage], +version 2.0, available at +https://www.contributor-covenant.org/version/2/0/code_of_conduct.html. + +Community Impact Guidelines were inspired by [Mozilla's code of conduct +enforcement ladder](https://github.com/mozilla/diversity). + +[homepage]: https://www.contributor-covenant.org + +For answers to common questions about this code of conduct, see the FAQ at +https://www.contributor-covenant.org/faq. Translations are available at +https://www.contributor-covenant.org/translations. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..6b73d26 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,138 @@ +# Contributing to PyCDP + +Thank you for your interest in contributing to Python Chrome DevTools Protocol (PyCDP)! We welcome contributions from the community. + +## Getting Started + +### Prerequisites + +- Python 3.7 or higher +- Poetry for dependency management +- Git for version control + +### Setting Up Development Environment + +1. Fork and clone the repository: + ```bash + git clone https://github.com/YOUR_USERNAME/python-chrome-devtools-protocol.git + cd python-chrome-devtools-protocol + ``` + +2. Install dependencies: + ```bash + pip install poetry + poetry install + ``` + +## Development Workflow + +### Code Generation + +This project automatically generates Python wrappers from the Chrome DevTools Protocol specification: + +```bash +poetry run python generator/generate.py +``` + +### Running Tests + +Run the test suite: +```bash +poetry run pytest test/ +poetry run pytest generator/ +``` + +### Type Checking + +We use mypy for static type checking: +```bash +poetry run mypy cdp/ +poetry run mypy generator/ +``` + +### Complete Build + +Run all checks (type checking, tests, and generation): +```bash +poetry run make default +``` + +## Submitting Changes + +### Pull Request Process + +1. Create a new branch for your feature or bugfix: + ```bash + git checkout -b feature/your-feature-name + ``` + +2. Make your changes and ensure: + - All tests pass + - Code passes type checking + - Code follows the existing style + - Documentation is updated if needed + +3. Commit your changes with clear, descriptive messages: + ```bash + git commit -m "Add feature: brief description" + ``` + +4. Push to your fork and submit a pull request: + ```bash + git push origin feature/your-feature-name + ``` + +5. In your pull request description: + - Describe what changes you made and why + - Reference any related issues + - Include any relevant context + +### Code Review + +- Maintainers will review your pull request +- Address any feedback or requested changes +- Once approved, a maintainer will merge your PR + +## Reporting Issues + +### Bug Reports + +When reporting bugs, please include: +- A clear, descriptive title +- Steps to reproduce the issue +- Expected behavior vs. actual behavior +- Python version and environment details +- Any relevant error messages or logs + +### Feature Requests + +For feature requests, please: +- Clearly describe the feature and its use case +- Explain why it would be valuable +- Provide examples if possible + +## Code Style + +- Follow PEP 8 style guidelines +- Use type hints for function parameters and return values +- Write clear, descriptive variable and function names +- Add docstrings for public APIs +- Keep functions focused and modular + +## Documentation + +- Update README.md if you add new features +- Update docstrings for any modified functions or classes +- Add examples for new functionality when appropriate + +## License + +By contributing, you agree that your contributions will be licensed under the MIT License. + +## Questions? + +If you have questions, feel free to: +- Open an issue for discussion +- Reach out to the maintainers + +Thank you for contributing to PyCDP! diff --git a/README.md b/README.md index 70504e3..e81be19 100644 --- a/README.md +++ b/README.md @@ -79,10 +79,6 @@ See the [examples directory](examples/) for more usage patterns. For users who prefer to manage their own I/O: -## Sans-I/O Mode (Original) - -For users who prefer to manage their own I/O: - ```python from cdp import page @@ -90,6 +86,33 @@ frame_id = page.FrameId('my id') assert repr(frame_id) == "FrameId('my id')" ``` -For more information, see the [complete documentation](https://py-cdp.readthedocs.io). +## API Documentation + +For detailed API documentation, see: + +- **[Complete Documentation](https://py-cdp.readthedocs.io)** - Full API reference on Read the Docs +- **[Chrome DevTools Protocol](https://chromedevtools.github.io/devtools-protocol/)** - Official CDP specification +- **[Examples](examples/)** - Code examples demonstrating usage patterns + +### Key Modules + +- `cdp.connection` - WebSocket I/O and connection management (I/O mode) +- `cdp.` - Type wrappers for each CDP domain (e.g., `cdp.page`, `cdp.network`, `cdp.runtime`) +- Each domain module provides types, commands, and events for that CDP domain + +## Contributing + +We welcome contributions! Please see our [Contributing Guide](CONTRIBUTING.md) for details on: + +- Setting up your development environment +- Running tests and type checking +- Submitting pull requests +- Reporting issues + +Please also read our [Code of Conduct](CODE_OF_CONDUCT.md) before contributing. + +## Security + +For information about reporting security vulnerabilities, please see our [Security Policy](SECURITY.md). define hyperion gray diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..b6d758e --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,139 @@ +# Security Policy + +## Supported Versions + +We take security seriously and provide security updates for the following versions: + +| Version | Supported | +| ------- | ------------------ | +| 0.5.x | :white_check_mark: | +| 0.4.x | :white_check_mark: | +| < 0.4 | :x: | + +## Reporting a Vulnerability + +If you discover a security vulnerability in PyCDP, please help us by responsibly disclosing it to us. + +### How to Report + +**Please do not report security vulnerabilities through public GitHub issues.** + +Instead, please report security vulnerabilities by: + +1. **Creating a private security advisory** on GitHub: + - Go to the [Security tab](https://github.com/HyperionGray/python-chrome-devtools-protocol/security) + - Click "Report a vulnerability" + - Provide detailed information about the vulnerability + +2. **Or by emailing** the maintainers directly: + - Include "SECURITY" in the subject line + - Provide a detailed description of the vulnerability + - Include steps to reproduce the issue + - Suggest a fix if possible + +### What to Include + +When reporting a vulnerability, please include: + +- Type of vulnerability (e.g., injection, XSS, authentication bypass) +- Full paths of source file(s) related to the vulnerability +- Location of the affected source code (tag/branch/commit or direct URL) +- Step-by-step instructions to reproduce the issue +- Proof-of-concept or exploit code (if possible) +- Impact of the vulnerability and potential attack scenarios + +### What to Expect + +- **Initial Response**: We aim to acknowledge receipt within 48 hours +- **Status Updates**: We'll keep you informed about our progress +- **Disclosure Timeline**: We'll work with you to understand the issue and develop a fix +- **Credit**: We'll acknowledge your contribution in release notes (unless you prefer to remain anonymous) + +## Security Best Practices + +When using PyCDP: + +### WebSocket Connections + +- **Always use TLS/SSL** for WebSocket connections in production (`wss://` not `ws://`) +- **Validate endpoint URLs** before connecting +- **Authenticate connections** properly to Chrome DevTools endpoints +- **Limit exposure** of CDP endpoints (use `--remote-debugging-port` carefully) + +### Input Validation + +- **Sanitize inputs** when sending commands to Chrome DevTools +- **Validate responses** from the browser +- **Handle errors gracefully** to prevent information disclosure + +### Dependency Management + +- **Keep dependencies up to date** using `poetry update` +- **Review security advisories** for dependencies +- **Use the optional `[io]` extra** only when needed to minimize dependency surface + +### Access Control + +- **Restrict access** to CDP endpoints to trusted clients only +- **Use proper authentication** when exposing CDP over a network +- **Monitor connections** for suspicious activity + +## Security Considerations + +### Chrome DevTools Protocol + +The Chrome DevTools Protocol provides powerful control over browser instances: + +- **Full DOM access**: Can read and modify page content +- **JavaScript execution**: Can execute arbitrary JavaScript in pages +- **Network interception**: Can intercept and modify network requests +- **Cookie access**: Can read and modify cookies +- **Storage access**: Can read and modify localStorage, sessionStorage, etc. + +### Important Warnings + +⚠️ **Never expose CDP endpoints to untrusted networks without authentication** + +⚠️ **Be cautious when connecting to untrusted CDP endpoints** + +⚠️ **Validate all data received from CDP to prevent injection attacks** + +⚠️ **Do not store sensitive credentials in CDP commands or scripts** + +## Known Security Considerations + +### WebSocket Security + +- WebSocket connections do not follow same-origin policy +- Ensure proper origin validation for CDP endpoints +- Use secure WebSocket connections (WSS) in production + +### Code Execution + +- CDP allows arbitrary JavaScript execution +- Validate and sanitize any user input before executing +- Be aware of potential for remote code execution vulnerabilities + +## Updates and Patches + +Security updates will be released as: + +- **Patch versions** for critical security fixes +- **GitHub Security Advisories** for documented vulnerabilities +- **CHANGELOG.md** entries for all security-related changes + +Subscribe to repository notifications to stay informed about security updates. + +## Additional Resources + +- [Chrome DevTools Protocol Documentation](https://chromedevtools.github.io/devtools-protocol/) +- [OWASP WebSocket Security](https://owasp.org/www-community/vulnerabilities/WebSocket_Security) +- [Python Security Best Practices](https://python.readthedocs.io/en/stable/library/security_warnings.html) + +## Contact + +For non-security issues, please use GitHub issues. + +For security concerns, please use the private reporting methods described above. + +Thank you for helping keep PyCDP and its users safe!