Description: The code uses env::var(program_files_env).unwrap_or_default() and then
Path::new(&env_value).join(&browser_path), which can fall back to an empty string and
produce a relative path (e.g., .\Microsoft\Edge...), potentially allowing execution of a
malicious msedge.exe from the current working directory if the expected ProgramFiles env
var is missing/misconfigured or controlled in a hostile environment.
edge.rs [494-513]

// Stable Edge MSI installs to Program Files (x86) for compatibility
// Beta/Dev/Canary MSIs install to Program Files
let (browser_path, program_files_env) = if self.is_unstable(browser_version) {
    (
        self.get_browser_path_from_version(browser_version)
            .to_string(),
        ENV_PROGRAM_FILES,
    )
} else {
    (
        format!(
            r"Microsoft\Edge\Application\{}\msedge.exe",
            self.get_browser_version()
        ),
        ENV_PROGRAM_FILES_X86,
    )
};
let env_value = env::var(program_files_env).unwrap_or_default();
let full_browser_path = Path::new(&env_value).join(&browser_path);
Ok((&path_to_string(&full_browser_path)).into())

• Create ticket/issue

Follow the guide to enable codebase context checks.

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status:
Silent env fallback: The new Windows Edge path resolution silently falls back to an empty Program Files
environment variable value via unwrap_or_default(), which can produce an incorrect
relative path without surfacing an actionable error.

let env_value = env::var(program_files_env).unwrap_or_default();
let full_browser_path = Path::new(&env_value).join(&browser_path);
Ok((&path_to_string(&full_browser_path)).into())

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status:
Potential sensitive logging: New debug logs include full local filesystem paths and full download URLs, which may
expose sensitive host details (e.g., user directory paths or URL query parameters)
depending on runtime values.

// Checking if browser version already in expected location
let browser_binary_path = self.get_browser_binary_path(original_browser_version)?;
if browser_binary_path.exists() {
    let location_note = if WINDOWS.is(self.get_os()) && self.is_edge() {
        " (Edge uses system path, not cache)"
    } else {
        ""
    };
    self.get_logger().debug(format!(
        "{} {} already exists at {}{}",
        self.get_browser_name(),
        browser_version,
        browser_binary_path.display(),
        location_note
    ));
    self.set_browser_path(path_to_string(&browser_binary_path));
    return Ok(Some(browser_binary_path));
}

// Browser not available, download it
if WINDOWS.is(self.get_os()) && self.is_edge() && !self.is_windows_admin() {


 ... (clipped 35 lines)

Learn more about managing compliance generic rules or creating your own custom rules

Replace env::var(...).unwrap_or_default() with a check that returns an error if
the environment variable is not set, preventing silent failures from creating
invalid paths.

rust/src/edge.rs [511-512]

-let env_value = env::var(program_files_env).unwrap_or_default();
-let full_browser_path = Path::new(&env_value).join(&browser_path);
+let env_value = env::var_os(program_files_env)
+    .ok_or_else(|| Error::msg(format!("Environment variable {} not set", program_files_env)))?;
+let full_browser_path = PathBuf::from(env_value).join(&browser_path);

• Apply / Chat

Ensure the lock is released even when get_browser_url_for_download,
download_to_tmp_folder, or uncompress returns an error by using an RAII guard
(e.g., Drop/scopeguard) or a match/finally-style pattern that always releases on
exit.

rust/src/lib.rs [344-385]

 let mut lock = Lock::acquire(self.get_logger(), &browser_path_in_cache, None)?;
+let _release_lock = scopeguard::guard((), |_| lock.release());
+
 // If lock file was deleted, another process held it and released (deleting the file).
 // Check if that process already downloaded the browser.
 if !lock.exists() && browser_binary_path.exists() {
     self.get_logger().debug(format!(
         "{} {} now available at {}",
         self.get_browser_name(),
         browser_version,
         browser_binary_path.display()
     ));
     self.set_browser_path(path_to_string(&browser_binary_path));
     return Ok(Some(browser_binary_path.clone()));
 }
 
 let browser_url = self.get_browser_url_for_download(original_browser_version)?;
 // Edge on Windows: MSI installs to system path, not cache
 let install_note = if WINDOWS.is(self.get_os()) && self.is_edge() {
     " (will install to system path via MSI)"
 } else {
     ""
 };
 self.get_logger().debug(format!(
     "Downloading {} {} from {}{}",
     self.get_browser_name(),
     self.get_browser_version(),
     browser_url,
     install_note
 ));
 let (_tmp_folder, driver_zip_file) =
     download_to_tmp_folder(self.get_http_client(), browser_url, self.get_logger())?;
 
 let browser_label_for_download =
     self.get_browser_label_for_download(original_browser_version)?;
 uncompress(
     &driver_zip_file,
     &browser_path_in_cache,
     self.get_logger(),
     self.get_os(),
     None,
     browser_label_for_download,
 )?;
-lock.release();

• Apply / Chat