Replace old headless Chromium with Chromium Headless Shell in DAST

Recently, the Chromium team changed the way Chromium is being packaged for developers. More details here: https://developer.chrome.com/blog/chrome-headless-shell

In past versions (I have tested upto version 129), Chromium includes both the old and new headless modes in a single release. However, recently this seems to have changed and the old headless mode is no longer included in the same release. I ran into the following error on my work machine which has Chromium 133 installed:

$ /Applications/Chromium.app/Contents/MacOS/Chromium --headless=old
Old Headless mode has been removed from the Chrome binary. Please use the new Headless mode (https://developer.chrome.com/docs/chromium/new-headless) or the chrome-headless-shell which is a standalone implementation of the old Headless mode (https://developer.chrome.com/blog/chrome-headless-shell).

Problem

We will no longer be able to use --headless=old with newer Chrome versions. Not sure of the exact version this will start affecting DAST but it will be 129+.

Possible Solutions

  1. Set --headless=shell
    1. Change this here
    2. Quick workaround that seems to work based on limited local testing with Chromium 133.
  2. Start using chromium-headless-shell
    • This seems to be the Chromium team's recommendation.
    • It is sourced from the npx meaning we could potentially have access to new and old versions of Chromium at the same time, something package repos currently don't have.
    • Question to investigate: Is this a drop in replacement for the old headless Chromium?
  3. Migrate to the new headless mode
    • We tried to do this in this MR earlier with the upgrade to Chrome 129 but it involves very broad changes to accommodate the new headless version.