Invariant-Based Automatic Testing of Modern Web Applications

Abstract

Abstract-AJAX-based Web 2.0 applications rely on stateful asynchronous client/server communication, and client-side run-time manipulation of the DOM tree. This not only makes them fundamentally different from traditional web applications, but also more error-prone and harder to test. We propose a method for testing AJAX applications automatically, based on a crawler to infer a state-flow graph for all (client-side) user interface states. We identify AJAX-specific faults that can occur in such states (related to e.g., DOM validity, error messages, discoverability, back-button compatibility) as well as DOM-tree invariants that can serve as oracles to detect such faults. Our approach, called ATUSA, is implemented in a tool offering generic invariant checking components, a plugin-mechanism to add application-specific state validators, and generation of a test suite covering the paths obtained during crawling. We describe three case studies, consisting of six subjects, evaluating the type of invariants that can be obtained for AJAX applications as well as the fault revealing capabilities, scalability, required manual effort, and level of automation of our testing approach.

Model-Based Testing in Cloud Brokerage Scenarios

“…Recent work [18,19] has explored test generation for rich-client applications, where the application's state is maintained as a DOM 11 -tree, manipulated both by client-side user-interactions and via asynchronous AJAX callbacks from the serverside. These approaches rely on automatic inference of a state-based model of the application, from which suitable test sequences might be determined.…”

oward Security Test Automation for Event Driven GUI Web Contents

“…We have paid some attention also to Asynchronous JavaScript and XML (AJAX) interfaces in websites as such contents are not readily accessible by crawlers, some specials tools and techniques should be situation like this. Since AJAXbased applications depend on asynchronous client/server communication and client-side processing of the DOM tree, testing web applications with AJAX content is pretty challenging compared to traditional web content [11]. (AJAX) is getting more and more popular in web applications for building client side interactive web applications.…”

“…The Approach of examining AJAX pages is a slightly bit similar to that used in [11]. There are three major differences between our test automation framework and the one proposed in [11], first we extracted DOM widgets vulnerable states based on different user interaction scenarios, second, our concentration in this framework is not only AJAX interfaces we are building test cases for both possible blocked contents and Dynamic Ajax interfaces, while in [11] the focus was on Ajax interface only.…”

“…There are three major differences between our test automation framework and the one proposed in [11], first we extracted DOM widgets vulnerable states based on different user interaction scenarios, second, our concentration in this framework is not only AJAX interfaces we are building test cases for both possible blocked contents and Dynamic Ajax interfaces, while in [11] the focus was on Ajax interface only. Our test Automation framework included a dynamic cycles to feed new inputs for those blocked content, eventually, the goal is to have as many security testing scenarios as possible.…”

“…In our proposed framework, many user interaction clickable events will be used as a collaboration scenario at the client level, hence any possible malicious change on the DOM (Document object Model) will be calculated based on DOM stable boundary [11], then a decision is made to consider event as malicious or not. Next a set of malicious events will be added to the vulnerable events database, ultimately, the complete test cases list will be composed of both vulnerable events of DOM AJAX interfaces and the blocked web contents.…”