I've checked what is sanitization of user inputs. And now I stuck with idea hot to automate tests for the sanitization of user inputs?
I'm new about this topic.
This is phrased a bit in "developer terminology." I highly encourage people in testing roles to learn more technical topics as this helps in communicating with your team.
Another way of saying "sanitization of user inputs" is: Do your user input fields behave correctly in positive ways, negative ways, or other ways? This gets into "validation" which is one way to ensure sanitization.
Here is where test case design utilizing Boundary Value Analysis and Equivalence Classes really helps. Of course, you also need to understand the requirements and rules your input fields have. We don't know the rules on the OPs question, so it's hard to be more specific.
For a brief example, let's talk about a login creation input where you have an input field for
username and another for
password. And let's have the following criteria:
What do your high-level test cases look like (non-exhastive)?
There are so many options here for invalid email addresses and invalid passwords based on the example criteria. Lots have been written on Boundary Value Analysis and Equivalence Classes, so use those as search terms here in the SQA Stack Exchange or via Google.
Already with these test cases, you have 1 positive test case and numerous negative test cases. For other test cases:
Sanitization can also look like:
Where does automation come in?
In general, sanitization and validation are all about defense programming!
There's a ton I can write on this topic, but hopefully, this gets you started in the right direction!
As the name validation suggests, input validation (also referred to as sanitizing input) is about examining what data the user is supplying against a number of rules and then providing feedback to the user about issues when their input fails these rules. The term 'sanitized' puts emphasis that only data that meets the rules ('is sanitized') is accepted and stored.
The most common example of this is typically seen in email and password inputs, for example email must have an @, password must have at least x number of characters, etc.
Automation of sanitization is then the same as other testing, i.e.
Testing through the browser is probably the first thing that comes to mind. It comes with two significant problems however (inherent in browser testing):
First, the route to get to the point where a validation can be long and complicated - not good for browser tests which are slow and flaky. Secondly, if you try to do all the validation in one UI test you are testing multiple conditions with one test and you lose the 'one assertion per test' approach.
Secondly, your specific validation tests may now be be dependent or interfered with by other tests. For this reason I recommend you consider having one happy and one sad path UI (browser) test (failing validation is a sad path test), then using unit tests to test all the variety of conditions. These could be either framework tests with the network stubbed out or backend unit tests if the validation is done there.
Input sanitization is a cybersecurity measure of checking, cleaning, and filtering data inputs from users, APIs, and web services of any unwanted characters and strings to prevent the injection of harmful codes into the system.
An application receives queries and requests from untrusted sources that might expose the system to malicious attacks. Input sanitization ensures that the entered data conforms to subsystem and security requirements, eliminating unnecessary characters that can pose potential harm.
Attackers have been using classic flaws for years with a pretty high success rate. Classic approaches such as SQL injection, XSS, RFI (remote file inclusion), or directory traversal are still the most common attacks.
Benefits of input sanitization:
For more details:
Automating tests for sanitization of user inputs involves testing the application's ability to correctly filter and modify user inputs to prevent security issues like XSS (Cross-Site Scripting), SQL Injection, etc. Here are the steps you can follow to automate such tests:
Identify the various types of inputs that can be entered into the application - text inputs, drop-down lists, radio buttons, etc.
For each input type, create a test case that tests the application's ability to sanitize user inputs.
Input different types of malicious data into each input field, such as SQL injection code, XSS script, etc.
Verify that the application properly sanitizes the input data and returns a safe result.
Repeat this process for each input type, making sure to cover all the different ways malicious data can be entered.
Finally, write automated tests to repeat these steps and verify that the application continues to properly sanitize user inputs.
Tools like Selenium and JUnit can be used to automate these tests. You can write code to input different types of malicious data into the application and verify that the application properly sanitizes the inputs and returns a safe result.
For more information on automated testing for sanitization of user inputs, you can refer to the OWASP (Open Web Application Security Project) guidelines on input validation and sanitization.
Both the upvoted answers are fantastic. Here's a TL;DR version:
a' or 1=1-- is a common one
Enjoy! This is a very fun one to automate.