0

I want to perform XSS by entering something like <script> alert (Testing)</script> into text fields. On my page, I have a combination of different types of form fields. The condition I need is, if it is a text field then that input should be set with my text or else just skip that web element.

I'm getting Exception in thread "main" org.openqa.selenium.ElementNotInteractableException: element not interactable error after it reaches a dropdown field.

Can anyone help me? Thanks in advance

List<WebElement> webElements= driver.findElements(By.xpath("//*"));
List<WebElement> txtfields = driver.findElements(By.xpath("//input[@type='text' or @type='password']"));
    
    for(int i=0;i<webElements.size();i++){

        for(int j=0;j<txtfields.size();j++){
            if(webElements.contains(txtfields.get(i))){
                txtfields.get(j).sendKeys("testing data " + (j + 1));
                Thread.sleep(3000);
                
            }
            else{
                continue;
                
            }
        }
        Thread.sleep(5000);
    }
2
  • What is the purpose webelements if u can get textfields ? Could you edit your question with more code logic , why u use something , what u expected , and all
    – PDHide
    Commented Jun 23, 2020 at 15:36
  • I want to perform XSS bypassing input script like alert (Testing) into text fields. On my page, I have a combination of text fields and dropdowns, etc., The condition I need, if it is a text filed then that input should send or else just skip that web element.
    – Arun Kumar
    Commented Jul 1, 2020 at 9:58

2 Answers 2

1

When you do driver.findElements(By.xpath("//input[@type='text' or @type='password']")); you just get a list of DOM nodes with specified properties. That doesn't mean they are all ready to take your input.

Hence you are encountering some that is not.. There are basically to ways you can to go:

  1. Good way: Do not take all inputs. Take the only inputs which have to be ready for the input so getting exception would mean a defect.
  2. Bad way: wrap your interaction with try..catch so that problematic interactions are simply ignored.
1

Let's start with looking at what your code is actually doing.

List<WebElement> webElements= driver.findElements(By.xpath("//*")); creates a list of every web element on the page. Not just every form field, every element. Every <p>, <br>, <div>,... you get the point.

List<WebElement> txtfields = driver.findElements(By.xpath("//input[@type='text' or @type='password']")); is doing what you actually want and locating every text input field on the page.

In your nested loops:

    for(int j=0;j<txtfields.size();j++){
        if(webElements.contains(txtfields.get(i))){
            txtfields.get(j).sendKeys("testing data " + (j + 1));
            Thread.sleep(3000);
            
        }

your conditional check is pointless because it's using the index of the outer loop, not the inner loop, and because you already have all the text input elements - you don't need to check the list of all elements.

Here's how I would approach this (pseudo-code-ish)

List<WebElement> txtfields = driver.findElements(By.xpath("//input[@type='text' or @type='password']"));
    
for(int j=0;j<txtfields.size();j++){
    if(txtfields.get(j).Enabled && txtfields.get(j).Displayed){
        txtfields.get(j).sendKeys("testing data " + (j + 1));
        Thread.sleep(3000);
    }
}

I'm using the .Enabled and .Displayed properties to avoid trying to interact with disabled fields.

I'd also look into avoiding Thread.sleep() - instead I'd consider using a dynamic wait like WebDriverWait.Until() or an expected conditions wait. Since I'm most familiar with C# these days, I'm not going to try to translate the C# syntax to Java.

While you're debugging, I'd also consider logging each step: something like (C# syntax here) Console.WriteLine(txtfields.get(j).TagName + " " + txtfields.get(j).Text) so you know which element is throwing errors.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.