• Create ticket/issue

Follow the guide to enable codebase context checks.

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status:
Audit logging: The changes largely refactor namespaces and adjust unsubscribe logic, and there is no
evidence in the new code lines that critical actions (e.g., subscribe/unsubscribe
operations) are being logged with user, timestamp, and outcome, but existing logging may
exist outside the shown diff.

public async Task UnsubscribeAsync(Subscription subscription)
{
    var eventHandlers = _eventHandlers[subscription.EventHandler.EventName];

    eventHandlers.Remove(subscription.EventHandler);

    await _bidi.SessionModule.UnsubscribeAsync([subscription.SubscriptionId]).ConfigureAwait(false);
}

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status:
Error handling: New imports and namespace changes are introduced but the diff does not show added
try/catch or contextual error handling for transport operations; however, full method
bodies are not included, so adequacy of error handling cannot be determined from the new
lines alone.

using OpenQA.Selenium.Internal.Logging;
using System;
using System.IO;
using System.Net.WebSockets;
using System.Text;
using System.Threading;
using System.Threading.Tasks;

namespace OpenQA.Selenium.BiDi;

class WebSocketTransport(Uri _uri) : ITransport, IDisposable
{

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status:
User-facing errors: The new code does not introduce user-facing error messages, but without visibility into
surrounding error paths it is unclear whether detailed internal errors might be exposed
elsewhere after these refactors.

using System.Threading;
using System.Threading.Tasks;

namespace OpenQA.Selenium.BiDi;

public sealed class Broker : IAsyncDisposable
{

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status:
Input validation: The changes primarily relocate JSON converters and namespaces without adding or removing
validation; security of input handling depends on converter implementations not shown
modified in this diff.

using System.Text.Json;
using System.Text.Json.Serialization;

namespace OpenQA.Selenium.BiDi.Json.Converters;

// Serializes and deserializes double into a BiDi spec-compliant number value.
// See https://w3c.github.io/webdriver-bidi/#type-script-PrimitiveProtocolValue

Learn more about managing compliance generic rules or creating your own custom rules

Avoid moving internal communication classes like Broker and WebSocketTransport
into the public OpenQA.Selenium.BiDi namespace. Instead, they should reside in a
distinct internal namespace to keep the public API clean.

Examples:

namespace OpenQA.Selenium.BiDi;

public sealed class Broker : IAsyncDisposable

Solution Walkthrough:

Before:

// File: dotnet/src/webdriver/BiDi/Broker.cs
namespace OpenQA.Selenium.BiDi;

public sealed class Broker : IAsyncDisposable
{
    // ... implementation ...
}

// File: dotnet/src/webdriver/BiDi/WebSocketTransport.cs
namespace OpenQA.Selenium.BiDi;

class WebSocketTransport(Uri _uri) : ITransport, IDisposable
{
    // ... implementation ...
}

After:

// File: dotnet/src/webdriver/BiDi/Communication/Broker.cs
namespace OpenQA.Selenium.BiDi.Communication;

// Consider making this class internal if not used publicly
public sealed class Broker : IAsyncDisposable
{
    // ... implementation ...
}

// File: dotnet/src/webdriver/BiDi/Communication/WebSocketTransport.cs
namespace OpenQA.Selenium.BiDi.Communication;

internal class WebSocketTransport(Uri _uri) : ITransport, IDisposable
{
    // ... implementation ...
}

Use a type alias for EventHandler to resolve potential ambiguity with
System.EventHandler and improve code clarity.

dotnet/src/webdriver/BiDi/Subscription.cs [31-37]

-private readonly EventHandler _eventHandler;
+private readonly BiDiEventHandler _eventHandler;
 
-internal Subscription(Session.Subscription subscription, Broker broker, EventHandler eventHandler)
+internal Subscription(Session.Subscription subscription, Broker broker, BiDiEventHandler eventHandler)
 {
     _subscription = subscription;
     _broker = broker;
     _eventHandler = eventHandler;
 }

[To ensure code accuracy, apply this suggestion manually]