Testing dynamic web applications Client-side testing Bypass testing User-session Data based testing
Client-side Testing of Web Applications
Meenakshi D’Souza
International Institute of Information Technology Bangalore.
Testing dynamic web applications Client-side testing Bypass testing User-session Data based testing
Overview
Introduction to relevant aspects of web applications.
Issues in testing of web applications.
Testing static hyper text web sites.
Testing dynamic web applications.
Client-side testing of web applications.
Server-side testing of web applications.
Testing dynamic web applications Client-side testing Bypass testing User-session Data based testing
Testing dynamic web applications
Testing dynamic web applications.
Client-side testing.
Server-side testing.
Testing dynamic web applications Client-side testing Bypass testing User-session Data based testing
Client vs. server side testing
For web applications, the user interface is on the client and
the actual software is on the server.
Clients and server are separated.
Tester typically has no access to data, state or the source
code on the server.
We begin with client-side testing strategies.
Testing dynamic web applications Client-side testing Bypass testing User-session Data based testing
Client-side (black-box) Testing
Clients provide inputs to web software residing on a server.
Test inputs: HTML form elements.
Text boxes, buttons, drop-down lists, links etc.
Inputs can be generated or chosen.
Supplied by the tester.
Generated randomly.
Generated from user-session data collected from previous users
of the software.
Bypass testing: Values that violate constraints on the inputs,
as defined by client-side information.
Testing dynamic web applications Client-side testing Bypass testing User-session Data based testing
Bypass testing approach to finding inputs
Web applications impose constraints on inputs through HTML
forms.
Constraints come in two forms:
Client-side script validation: Programs run on the client to
check the syntax of input data before sending it to server.
Uses explicit attributes associated with HTML form fields.
E.g., a text box can be set to only allow strings up to a
maximum length.
Bypass testing creates inputs that intentionally violate these
validation rules and constraints.
Created inputs are directly submitted to the web application
without letting the web page validate them.
Testing dynamic web applications Client-side testing Bypass testing User-session Data based testing
Bypass testing: Example
User name: Age:
Version to purchase:
1
0
1
0
Small Medium Large
Testing dynamic web applications Client-side testing Bypass testing User-session Data based testing
Abbreviated HTML for example
<FORM>
<INPUT Type=”text” Name=”username” Size=20>
<INPUT Type=”text” Name=”age” Size=3 Maxlength=3>
<P> Version to purchase:
<INPUT Type=”radio” Name=”version” Value=”150” Checked>
<INPUT Type=”radio” Name=”version” Value=”250”>
<INPUT Type=”radio” Name=”version” Value=”500”>
<INPUT Type=”submit” onClick=”return checkInfo([Link])”>
<INPUT Type=”hidden” isLoggedIn=”no”>
</FORM>
Testing dynamic web applications Client-side testing Bypass testing User-session Data based testing
Bypass testing: Example
User name: Alan >Turing Age: 500 User name should
be plain text only.
Version to purchase:
Age should be
1
0
0
1
between 18 and
Small Medium Large
110.
Testing dynamic web applications Client-side testing Bypass testing User-session Data based testing
Bypassing Abbreviated HTML example
<FORM>
<INPUT Type=”text” Name=”username” Size=20>
<INPUT Type=”text” Name=”age” Size=3 Maxlength=3>
<P> Version to purchase:
<INPUT Type=”radio” Name=”version” Value=”150” Checked>
<INPUT Type=”radio” Name=”version” Value=”250”>
<INPUT Type=”radio” Name=”version” Value=”500”>
<INPUT Type=”submit” onClick=”return checkInfo([Link])” >
<INPUT Type=”hidden” isLoggedIn=”no”>
</FORM>
Testing dynamic web applications Client-side testing Bypass testing User-session Data based testing
Bypass testing
The basic idea in bypass testing is to let a tester save and
modify the HTML.
This way, client side checking/validation done routinely is
by-passed and the modified data is sent to server.
It can be used to see if the server crashes on the modified
data.
Checks for security and robustness.
Also checks for common mistakes in inputs.
Testing dynamic web applications Client-side testing Bypass testing User-session Data based testing
Bypass testing: Client vs. server side
Bypass testing modifies inputs.
Can be done at the client side or server side.
Client side inputs are safer and easier to handle.
Server side inputs can be modified too, but, can be risky if
they corrupt data in the server.
Testing dynamic web applications Client-side testing Bypass testing User-session Data based testing
Types of client input validation
Client side input validation is performed by HTML form
controls, their attributes and client side scripts that access
DOM.
Validation types are categorized as HTML and scripting.
HTML supports syntactic validation.
Client scripting can perform both syntactic and semantic
validation.
HTML Scripting constraints
Length (max input characters) Data Type (e.g. integer check)
Value (preset values) Data Format (e.g. ZIP code format)
Transfer Mode (GET or POST) Data Value (e.g. age value range)
Field Element (preset fields) Inter-Value (e.g. credit # + expiry date)
Target URL (links with values) Invalid Characters (e.g. <,&)
Testing dynamic web applications Client-side testing Bypass testing User-session Data based testing
Example client-side constraint rules
Violate size restrictions on strings
Introduce values not included in static choices
Radio boxes
Select (drop-down) lists
Violate hard-coded values
Use values that JavaScript flag as errors
Change “transfer mode” (get, post, ...)
Change destination URLs
Testing dynamic web applications Client-side testing Bypass testing User-session Data based testing
Example server-side constraint rules
Data type conversion
Data format validation
Inter-field constraint validation
Inter-request data fields (cookies, hidden)
Testing dynamic web applications Client-side testing Bypass testing User-session Data based testing
Example security violation rules
The following modifications could be done to check for typical
security vulnerabilities:
Empty String
Commas: ,
Single and double quotes: ’ or ”
Tag symbols: < and >
Directory paths: .. ../
Strings starting with forward slash: /
Strings starting with a period: .
Ampersands: &
Control character: NIL, newline
Characters with high bit set: 254 and 255
Testing dynamic web applications Client-side testing Bypass testing User-session Data based testing
Modeling HTML inputs
Test cases to a web application are HTML files.
A static file or a dynamic file with two types of inputs:
HTML links and forms.
A form input unit is a HTML form that specifies the server
software component as the action attribute within the form
tag. The input data corresponds to all the input fields within
the form.
A link input unit is a HTML link in an <A> tag, with a target
URL specified as an attribute.
Transfer mode (GET, POST) is also a part of the input, links
typically generate only GET requests.
Testing dynamic web applications Client-side testing Bypass testing User-session Data based testing
Choosing/generating HTML inputs
HTML inputs can include more than one form and each form
can include many input fields.
Automatic input generation is difficult, the various inputs can
be very large in number.
Many web pages contain redundant (identical) input forms,
they can be composed or merged before generating inputs
through bypass testing. For e.g., many web pages contain the
form for searching once at the top of the page and again at
the end of the page.
Similarly, some inputs can be optional and they need not be
considered when the matching data is not considered.
These help to reduce the number of different inputs.
Testing dynamic web applications Client-side testing Bypass testing User-session Data based testing
Bypass Testing: Value level
Value level bypass testing tries to verify if a web application
adequately evaluates invalid inputs.
Data type conversion violation.
Built-in length restriction violation.
Built-in value restriction violation.
Special input values, especially those that could corrupt data
and cause a security vulnerability.
Testing dynamic web applications Client-side testing Bypass testing User-session Data based testing
Bypass Testing: Parameter level
Parameter level bypass testing tries to check for issues related
to relationships among different parameters of an input.
For e.g., inter-value constraints like credit card number and an
expiry date, built-in data access, built-in input field selection.
It is difficult to determine the relationships among parameters
for dynamically generated HTML files.
We consider all the possible input formats (after applying
possible merging), their relationships and generate violating
inputs.
Empty input patterns.
Universal input patterns for all possible violations.
Differential input pattern: Valid values for all parameters along
with a value for one parameter that is invalid.
Testing dynamic web applications Client-side testing Bypass testing User-session Data based testing
Bypass Testing: Control flow level
Control flow level bypass testing tries to verify web applications by
executing test cases that break the normal execution sequence.
Begin by identifying “normal” control flow in the HTML page,
can be done by doing simple parsing.
Need to extend it to identify normal control flows for all
possible inputs (can be difficult).
Two types of control flow alterations:
Backward and forward control flow alteration.
Arbitrary control flow alteration.
Testing dynamic web applications Client-side testing Bypass testing User-session Data based testing
User-session Data based Testing
A testing approach that uses data captured during user
sessions to create test cases.
Reduces the effort involved when test engineers are required
to generate test cases.
Empirically proven to find faults in web sites related to first
time users, sudden spike in the number of users etc.
Testing dynamic web applications Client-side testing Bypass testing User-session Data based testing
Sequence diagram of a web application
A web server responds to client requests through HTML files.
Requests could be just a URL or data sent through a form.
Data is a set of name-value pairs along with a POST/GET.
A database server is involved here.
Testing dynamic web applications Client-side testing Bypass testing User-session Data based testing
Collecting user session data
Collect all client request information. This can be accomplished
based on the underlying web application development technologies
used.
An Apache web server can be used to log all the received GET
requests.
All the name-value pairs can be captured by adding snippets
to invoke a server-side logging script.
Use Java servelet filters.
Incorporate cookies into the HTML files that are loaded in an
interaction.
Ensure that the web application performance does not get
impacted.
Testing dynamic web applications Client-side testing Bypass testing User-session Data based testing
User-session Data based Testing: Types
Three stand-alone variants of the basic approach involving
direct use of the session data.
1 Directly reuse entire sessions,
2 Replay a mixture of sessions, and
3 Replay sessions with some targeted modifications.
Two hybrid variants that combine the basic approach with
other functional testing techniques.
Testing dynamic web applications Client-side testing Bypass testing User-session Data based testing
Some definitions and terms
Let U = {u1 , u2 , . . . um } be a set of user sessions, with ui
consisting of n requests r1 ; r2 ; . . . rn , where each ri consists of
url[name − value]∗ .
For simplicity, we define a user session as beginning when a request
from a new IP address reaches the server and ending when the user
leaves the website or the session times out.
Testing dynamic web applications Client-side testing Bypass testing User-session Data based testing
First technique: Direct reuse
Simplest of all techniques.
Transform each ui ∈ U into a test case by formatting each of
its associated requests, r1 , r2 , . . . rn into an http request that
can be sent to a web server.
The resulting test suite contains m test cases, one for each
user session.
Testing dynamic web applications Client-side testing Bypass testing User-session Data based testing
Second technique: Combine different sessions
Select an unused session ua from U.
Copy requests r1 through ri from ua , where i is a random
number, 1 ≤ i ≤ n, into the test case.
Randomly select session ub from U, where b 6= a, and search
for any rj in ub with the same URL as ri .
If an rj with the same URL is not found in ub , select another
session ub . If there is no such ub , then consider direct reuse.
If an rj with the same URL as ri is found in ub , then add all
the requests following rj from ub into the test case after ri .
Mark ua as “used”, repeat the process until no more unused
sessions are available in U.
Testing dynamic web applications Client-side testing Bypass testing User-session Data based testing
Third technique: Reuse sessions with form modifications
Main idea: Replay user sessions by modifying the input forms that
can alter the behaviour of the web application.
Select an unused session ua from U.
Randomly select an unused request ri from ua . If there are no
more unused ri in ua , then reuse ua directly as a test case.
If ri does not contain at least one name-value pair, mark ri as
used and repeat previous step.
If ri has one or more name-value pairs, then modify the
name-value pairs.
1 Create one test case for each name-value pair by deleting a
random character in the value string.
2 Create one test case by modifying the values of all the pairs at
once by deleting a random character in each value string.
3 . . . . . ..
Mark ua as “used” and repeat the process until no more
unused sessions are available in U.
Testing dynamic web applications Client-side testing Bypass testing User-session Data based testing
Some references
Here are some references for web applications testing.
Sebastian Elbaum, Gregg Rothermel, Srikanth Karre and Marc
Fisher II, Leveraging user-session data to support web
application testing, in IEEE Transactions on Software
Engineering, 31(3), 2005.
Jeff Offutt, Ye Wu, Xiaochen Du and Hong Huang, Bypass
testing of web applications, in Proc. IEEE ISSRE, 2004.
Jeff Offutt and Ye Wu, Modeling presentation layer of web
applications for testing, Software and Systems Modelling,
9(2), 257-280, 2010.