fix: filter() uses values instead of keys, strips extension capabilities

[daifma]

Problem

The filter() method in WebDriver.php has three bugs:

Bug 1: Callback receives values instead of keys

The current code:

array_filter($capabilities, function ($capability) {
    return self::$w3cCapabilities[$capability] ?? 0;
})

array_filter passes values to the callback by default. When a capability value is an array
(e.g. goog:chromeOptions → ['args' => ['--no-sandbox']]), PHP tries to use the array as
an array key in self::$w3cCapabilities[$capability], causing a TypeError crash.

Bug 2: Extension capabilities are stripped

Even if Bug 1 were fixed, the filter only allows keys present in $w3cCapabilities. This strips
all extension capabilities like
goog:chromeOptions, moz:firefoxOptions, ms:edgeOptions, etc. Per the W3C spec, extension
capabilities are identified by containing a : in the key name and MUST be allowed through.

Bug 3: array_values destroys key-value pairs

The original code wraps the result in array_values(), which reindexes the array numerically.
This destroys the capability name → value mapping, turning
{"browserName": "chrome"} into ["chrome"].

Fix

- return $capabilities ? array_values(array_filter($capabilities, function ($capability) {
-     return self::$w3cCapabilities[$capability] ?? 0;
- })) : null;
+ return $capabilities ? array_filter($capabilities, function ($key) {
+     return isset(self::$w3cCapabilities[$key]) || str_contains($key, ':');
+ }, ARRAY_FILTER_USE_KEY) : null;

Changes:

1. Use ARRAY_FILTER_USE_KEY so the callback receives keys not values
2. Allow extension capabilities (keys containing :) per W3C spec
3. Remove array_values() to preserve the key-value mapping

How to reproduce

1. Configure capabilities with goog:chromeOptions:

   $capabilities = ['goog:chromeOptions' => ['args' => ['--no-sandbox']]];

2. Call $webDriver->session('chrome', $capabilities)
3. Observe: TypeError because array(['args' => ...]) is used as array key

References

• W3C WebDriver spec — Extension capabilities: https://www.w3.org/TR/webdriver2/#dfn-extension-capability
• PHP array_filter with ARRAY_FILTER_USE_KEY: https://www.php.net/array_filter

[aik099]

@daifma , what the filter method is supposed to do: delete capabilities with the empty values?

If that is so, then we might risk deleting some capabilities that are enabled by default, but the user wants them disabled.

[daifma]

@aik099 Good question, thanks for the review!

No, the filter() method is not meant to remove capabilities with empty/falsy values. Its purpose is to whitelist valid capability keys — keeping only W3C standard capabilities and vendor extension capabilities (those containing : like goog:chromeOptions).

The critical part of the fix is the ARRAY_FILTER_USE_KEY flag: it makes array_filter() pass only the key (e.g. "acceptInsecureCerts") to the callback. The value is never examined. So:

$capabilities = [
    'acceptInsecureCerts' => false,  // kept — key is in $w3cCapabilities
    'browserName' => 'chrome',       // kept — key is in $w3cCapabilities  
    'goog:chromeOptions' => [...],   // kept — key contains ':'
    'unknownCap' => 'value',         // removed — not W3C, no ':'
];

Capabilities set to false, 0, null, or any falsy value are preserved correctly as long as their key is valid.

The old code had the opposite problem: without ARRAY_FILTER_USE_KEY, the callback received values instead of keys (e.g. 'chrome', false, [...]). It tried to use these values as lookup keys in $w3cCapabilities, which either removed everything (since 'chrome' isn't a key in the whitelist) or threw a TypeError when the value was an array.