Selenium Version and Chrome Version

[Illia]

Hi there,

Can I know how to check ZAP's Selenium version? 

Been seeing this error message in CMD when I run the scan using -cmd parameter

Unable to find version of CDP to use for . You may need to include a dependency on a specific version of the CDP using something similar to `org.seleniumhq.selenium:selenium-devtools-v86:4.10.0` where the version ("v86") matches the version of the chromium-based browser you're using and the version number of the artifact is the same as Selenium's.

Does this mean that I can only use Chrome and chromedriver version 86?

As the latest update is v117 so I'm afraid I am missing out on security updates. 

[Illia]

I also saw on the documentation that it wrote version 56 and 60 is known to work but as now Chrome latest version is v117, v56 and 60 seems a little too old

[Illia]

Just for the info, my full command line is like this:

.\zap.bat -cmd -config network.connection.timeoutInSecs=180 -config rules.domxss.browserid=chrome-headless -autorun session.yaml -session "path\to\session"

[Simon Bennetts]

Hiya,

I think the key thing is the version of chrome driver.

Have you updated all of the ZAP add-ons?

The latest ZAP webdriver add-ons all include ChromeDriver 117.0.5938.62

FYI we are currently using Selenium 4.11.0 but have updated dev to Selenium 4.12.1

https://github.com/zaproxy/zap-extensions/blob/main/addOns/selenium/CHANGELOG.md

Cheers,

Simon

[Lia]

Hey Simon,

I have checked and in this path, the chromedriver is v117:

C:\Users\Local User\OWASP ZAP\webdriver\windows\32

While in this path, it is not updated to the latest version, it is using v114:

C:\Windows\System32\config\systemprofile\OWASP ZAP\webdriver\windows\32

How to make the chromedriver in the second path updated automatically? In another thread, I have asked for help and it seems that when I run ZAP scan via CICD pipeline it is using the second path.

Also, any idea why only chromedriver in 32 folder is updated and not the 64 folder?

Thanks

[Simon Bennetts]

Hiya,

Make sure you enable updates when running ZAP in CICD, its as simple as that.

ZAP just uses one directory for the user configs / add-ons etc (with sub directories of course).

It will update the files in that directory if you tell it to, e.g. using the '-addonupdate' command line option: https://www.zaproxy.org/docs/desktop/cmdline/

Cheers,

Simon

[Lia]

Hiya Simon, 

Thanks for the suggestion. I'll try adding '-addonupdate' command line option when running via CICD.

Hence one thing I would like to make clear, when I am running ZAP scan via CICD pipeline, which directory it is using?

C:\Users\Local User\OWASP ZAP

or

C:\Windows\System32\config\systemprofile\OWASP ZAP

Please see this thread where thc202 has replied to me:

https://groups.google.com/g/zaproxy-users/c/eRzgFigvLEg/m/PYWvqY4-BAAJ

[Simon Bennetts]

I have no idea, as it will depend on which user you are running it as :)

The 'definitive' answer is https://www.zaproxy.org/faq/what-is-the-default-directory-that-zap-uses/

Cheers,

Simon

[Lia]

Then if I assume when I run the scan via CICD pipeline, it is running as a "gitlab-runner" service (which is using this path:  C:\Windows\System32\config\systemprofile\OWASP ZAP)

In this case, what do you think if I add the -dir parameter specifying this path:  C:\Users\Local User\OWASP ZAP

Do you think its ok? 

[thc...@gmail.com]

No, you can use newer Chrome versions, assuming you have the add-ons
up-to-date.

The CDP version and Chrome version does not have a one to one mapping,
newer Chrome versions might use an older CDP version.

(In any case we are not using any CDP APIs.)

Best regards.

On 13/09/2023 09:08, Illia wrote:
> Hi there,
>
> Can I know how to check ZAP's Selenium version?
> Been seeing this error message in CMD when I run the scan using -cmd
> parameter
>

> *Unable to find version of CDP to use for . You may need to include a

> dependency on a specific version of the CDP using something similar to
> `org.seleniumhq.selenium:selenium-devtools-v86:4.10.0` where the version
> ("v86") matches the version of the chromium-based browser you're using and

> the version number of the artifact is the same as Selenium's.*

[Lia]

Hi thc202,

I have added the -addonupdate into my command line as per Simon's suggestion.

I am also using the latest version of Chrome browser:  117.0.5938.89 64 bit

And the chromedriver version is  117.0.5938.62

But I am still getting this message in the console:

WARNING: Unable to find version of CDP to use for . You may need to include a dependency on a specific version of the CDP using something similar to `org.seleniumhq.selenium:selenium-devtools-v86:4.10.0` where the version ("v86") matches the version of the chromium-based browser you're using and the version number of the artifact is the same as Selenium's.

 org.openqa.selenium.devtools.CdpVersionFinder findNearestMatch

WARNING: Unable to find CDP implementation matching 1

[thc...@gmail.com]

That might be an issue extracting the version, but as mentioned before
ZAP is not using the CDP APIs so that warning can be safely ignored.

Alternatively you could try with a weekly release which is using a newer
version of Selenium.

Best regards.

On 18/09/2023 10:04, Lia wrote:
> Hi thc202,
>
> I have added the -addonupdate into my command line as per Simon's
> suggestion.
> I am also using the latest version of Chrome browser: 117.0.5938.89 64 bit
> And the chromedriver version is 117.0.5938.62
>
> But I am still getting this message in the console:
>

> *WARNING: Unable to find version of CDP to use for . You may need to

> include a dependency on a specific version of the CDP using something
> similar to `org.seleniumhq.selenium:selenium-devtools-v86:4.10.0` where the
> version ("v86") matches the version of the chromium-based browser you're

> using and the version number of the artifact is the same as Selenium's.*
>
> * org.openqa.selenium.devtools.CdpVersionFinder findNearestMatch*
>
> *WARNING: Unable to find CDP implementation matching 1*

[Lia]

Alright, noted on that.

Also just want to check, whenever there is a new update for Windows Webdrivers, I notice that the latest version for chrome driver will only be updated in the 32 folder. 

Hence if I am using 64 bit Chrome browser and my selenium zap path is pointing to this path, will there be any problems?
C:\Users\Local User\OWASP ZAP\webdriver\windows\32\chromedriver.exe

[thc...@gmail.com]

I'm not aware of any problems using the 32bit ChromeDriver with the
64bit Chrome.

The WebDriver add-on was updated to include the 64bit ChromeDriver though.

Best regards.

[Lia]

Hi thc202,

Yes, I updated and now it is showing chromedriver.exe in the 64 bit folder too.

Thanks for the replies!