rules-playwright

RISK: exposing a Node function that shells out gives the page-under-test RCE on the test host via any compromised script. FIX: never bridge child_process through exposeFunction; use a narrowly typed helper with fixed args.

RISK: hardcoded credentials in spec files leak through git history and shared repos. FIX: read from process.env / CI secret store and reference via env vars in playwright.config.

RISK: launching Chromium with --no-sandbox disables the OS-level renderer sandbox and lets a compromised page escalate to the host. FIX: run tests as a non-root user in CI so the sandbox works, or use the official mcr.microsoft.com/playwright image.

RISK: Playwright MCP Server < 0.0.40 is vulnerable to CVE-2025-9611 (DNS rebinding via unvalidated Origin). FIX: upgrade to >= 0.0.40 and set allowedHosts.

RISK: page.waitForTimeout() is a flaky anti-pattern (too short on slow CI, too slow on fast machines) and is deprecated for production tests. FIX: use web-first assertions (expect(locator).toBeVisible()), waitForResponse, or waitForLoadState.

RISK: storageState files contain live session cookies/tokens and must never be committed. FIX: add playwright/.auth/ to .gitignore and regenerate the state via a global setup.

RISK: interpolating request-controlled values into route.fulfill() body can inject HTML/JS into the page under test, masking real XSS. FIX: JSON.stringify structured bodies or escape untrusted fields before fulfilling.

RISK: Playwright < 1.55.1 is affected by CVE-2025-59288 — the browser installer used curl -k and skipped TLS verification, enabling MitM RCE. FIX: upgrade to playwright >= 1.55.1.

RISK: string-interpolated template literals in page.evaluate() allow arbitrary JS execution in page context if any value is attacker-influenced. FIX: pass values as the second arg to evaluate(fn, arg) so they are serialized, not concatenated.

RISK: ignoreHTTPSErrors: true disables TLS validation and exposes tests to MitM/credential theft. FIX: remove the option and trust the test CA via NODE_EXTRA_CA_CERTS or a proper cert.