Skip to main content

When Test Automation Fails and exploratory Testing rocks

This post describes how I discovered a defect which allowed me to gain higher privilege than I was supposed to as a normal user. When testing an application I came across a use case when a privileged user would be allowed to delete a team and non privileged user would not be. Delete operation is controlled by displaying of a link. This is how it looks like for a privileged user -


Screenshot from 2016-05-30 15:37:05.png
And this is how it look for a non privileged user -


Screenshot from 2016-05-30 15:38:02.png
Here “Delete team” link is missing for non privileged user.

Having a look at html source code, I found following for the privileged user -


<a class="delete right" data-bind="if: teamProfile().type() != 'official', click: deleteTeam" href="https://test.com/" title="Delete this team">Delete team...</a>
And following for the non privileged user -


         <a class="delete right" data-bind="if: teamProfile().type() != 'official', click: deleteTeam" href="https://test.com/" title="Delete this team"></a>
The only difference is the missing inner text for delete link for non privileged user. Hence I modified the delete link of non privileged user as -


<a class="delete right" data-bind="if: teamProfile().type() != 'official', click: deleteTeam" href="https://draft.blogger.com/null" title="Delete this team">Delete</a>
This brought the Delete link on front end which was missing on previous snapshot -
Screenshot from 2016-05-30 15:45:21.png
When clicked on Delete link then voila, I got the confirmation prompt message of team deletion -


Screenshot from 2016-05-30 15:45:50.png

I was automating this use case by verifying the absence of delete link for non privileged user. Which would run perfect without reporting any bug. But we can see from example above that doing a little exploratory testing helped uncovered a defect which would have been missed from automated tests :-)


Do you have a similar story to share when automated testing helped you uncover a defect?

Labels:

Popular posts from this blog

How can you save resources when instantiaing driver?

I asked on my previous post about what was wrong in instantiating driver on set up method? And here is the solution video on my YouTube channel (After 5 years of gap I finally added new video tutorial :)) The solution described on video tutorial uses following set up - public class BaseClassOnDemandDriverSetup { private WebDriver driver ; @BeforeMethod public void setupTest () { // Any other set up goes here } @AfterMethod public void teardown () { if ( driver != null ) { driver .quit() ; } } public WebDriver getDriver () { if ( driver == null ) { WebDriverManager. chromedriver ().setup() ; driver = new ChromeDriver() ; } return driver ; } }
2 comments
Read more

Security Testing and Selenium

I have come across many articles which talk of carrying out security testing with selenium however I found it very cumbersome to set up such tests. This is what this tutorial is going to make easy for you. It cover. My next Security Testing and Selenium YouTube video covers following - Importance of having security testing on CI What is dynamic application security testing Recommended tools from https://owasp.org/www-community/Vulnerability_Scanning_Tools What is https://owasp.org/ ?   Using https://www.zaproxy.org/    Project setup  <dependency> <groupId> org.zaproxy </groupId> <artifactId> zap-clientapi </artifactId> <version> 1.9.0 </version> </dependency> <dependency> <groupId> org.zaproxy </groupId> <artifactId> zap </artifactId> <version> 2.10.0 </version> </dependency> Start ZAP daemom (headless) mode  ./zap.sh -daemon -host 127.0.0.1 -port 8080 -config api.addrs.a
Post a Comment
Read more

Using chrome console to test xPath and css selectors

Since the advent of selenium there have been many plugin to test xPath / css selectors but you don’t need any of them if you have chrome browser. Using Chrome console you can test both xPath and css selectors. Launch website to be tested in chrome browser and hit F-12 and you would see chrome console opened in lower pane of application - Hit escape key and console would open another pane to write element locators - And now you can start writing xPath or css selectors in chrome console and test them - The syntax for writing css id - $$(“ ”) And hit the enter key. If your expression is right then html snippet of the application element corresponding to the css selector would be displayed - If you mouse over the html snippet in chrome console then it would highlight the corresponding element in application - If you want to clean console of previously written element selectors then just hit ctrl+L keys and chrome console would be empty again. Pro
Read more