Web application test method and system based on browser assistance

Abstract

The invention discloses a Web application testing method and system based on browser assistance, and relates to the technical field of network security testing. The method comprises the following steps: analyzing whether a target Web application has a dependency relationship of JavaScript feature reference and / or a dynamic field, judging whether the target Web application needs a browser auxiliary test, and generating corresponding mark data; the proxy server injects a JavaScript code used for processing the replay request into a browser instance of the target Web application; the browser client analyzes the replay request, extracts a dynamic field of a current page of the browser instance, updates parameters of the dynamic field, and initiates the replay request to the target server according to the updated parameters of the dynamic field; and the test tool performs defect logic detection on the target Web application according to response data of the replay request. According to the invention, the replay request bypasses the protection mechanism of the target server, the test flow is efficiently sent, repeated analysis is avoided, and the efficiency of the test system is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security testing, and in particular to a browser-assisted Web application testing method and system. Background Art

[0002] Traditional web application testing systems face numerous technical challenges when processing web applications. Traditional request replay tools employ a simple HTTP request replication mechanism, directly modifying parameters and replaying historical requests. However, this approach completely ignores the JavaScript dynamic content generation and complex protection mechanisms widely used in modern web applications. Cookies, headers, and local storage in modern web applications often contain dynamic fields necessary for request validation. The values ​​of these fields change dynamically based on factors such as user sessions, timestamps, and random numbers. Traditional testing tools are unable to recognize the existence of these dynamic fields, let alone update test request parameters based on the actual values ​​in the current browser environment. This results in test requests failing to execute properly due to validation failures. While manual testing tools can provide good testing results in certain scenarios, they require testers to conduct detailed analysis and configuration of the technical characteristics of each target application. This approach is not only inefficient, but also, with the rapid development of web application technology, the maintenance cost of manual configuration is increasing.

[0003] These shortcomings in web application testing technology significantly reduce test replay success rates. During automated test replay, due to an inability to handle dynamic protection mechanisms and dynamic field dependencies, a large number of test requests fail due to verification failures, signature errors, token expiration, and other reasons, severely impacting test effectiveness. Unable to deeply analyze the target application's JavaScript features and dynamic field dependencies, the testing system is unable to establish an effective application model, resulting in insufficient test coverage and difficulty uncovering deep-seated application defects hidden within complex business logic. Summary of the Invention

[0004] In view of the above-mentioned defects or deficiencies in the prior art, the present invention provides a browser-assisted Web application testing method and system to solve the above-mentioned technical problems mentioned in the background art.

[0005] One aspect of the present invention provides a browser-assisted web application testing method, comprising the following steps: The testing tool sends a test request to a target server of a target Web application and receives a response header and response content returned by the target server; analyzes the target Web application based on the response content to determine whether there is a JavaScript feature reference, and analyzes the request content to determine whether there is a dynamic field dependency; if there is a JavaScript feature reference and / or a dynamic field dependency, generates tag data requiring browser-assisted testing and saves the tag data to a tag database corresponding to the target Web application; and sends a replay request for the test request to a proxy server; The proxy server receives and analyzes the replay request sent by the test tool, and if the tag data exists in the tag database of the target web application targeted by the replay request, injects JavaScript code for processing the replay request into the browser instance of the target web application; The browser client receives and executes the JavaScript code, establishes a WebSocket connection between the proxy server and the browser instance, receives and parses the replay request forwarded by the proxy server through the WebSocket connection, extracts the dynamic fields of the current page of the browser instance and updates the parameters of the dynamic fields, and initiates a real replay request to the target server based on the updated dynamic field parameters; The browser client receives the response data of the replay request returned by the target server and forwards the response data to the proxy server; the proxy server forwards the response data to the testing tool, and the testing tool performs defect logic detection of the target Web application based on the response data.

[0006] Another aspect of the present invention further provides a browser-assisted Web application testing system, comprising: The testing tool is configured to send a test request to a target server of a target Web application and receive a response header and response content returned by the target server; analyze, based on the response content, whether the target Web application contains a JavaScript feature reference, and analyze, based on the request content, whether there is a dynamic field dependency; if a JavaScript feature reference and / or a dynamic field dependency exists, generate tag data requiring browser-assisted testing and save the tag data to a tag database corresponding to the target Web application; send a replay request of the test request to a proxy server, and perform defect logic detection of the target Web application based on the response data of the replay request forwarded by the proxy server; The proxy server is configured to receive and analyze the replay request sent by the test tool, and if the tag data exists in the tag database of the target web application targeted by the replay request, inject JavaScript code for processing the replay request into the browser instance of the target web application; receive response data of the replay request forwarded by the browser client, and forward the response data to the test tool; The browser client is configured to receive and execute the JavaScript code, establish a WebSocket connection between the proxy server and the browser instance, receive and parse the replay request forwarded by the proxy server through the WebSocket connection, extract the dynamic fields of the current page of the browser instance and update the parameters of the dynamic fields, initiate a real replay request to the target server based on the updated dynamic field parameters, receive response data of the replay request returned by the target server, and forward the response data to the proxy server; The target server is used to receive the test request and return the response header and response content of the test request to the test tool; receive the real replay request initiated by the browser client, and return the response data of the replay request to the browser client.

[0007] The browser-assisted Web application testing method and system provided by the present invention analyzes the dependencies between dynamic fields and request parameters by detecting features such as specific JavaScript library references, dynamic script loading, and key function calls, and establishing a dynamic field analysis system including cookies, headers, and a browser status library. This determines whether browser assistance is required and establishes a tag database containing test target features. The persistent tag data in the tag database is used to determine whether browser assistance is required and to indicate which fields should be dynamically updated when replaying requests. These measures enable replay requests to bypass the target server's protection mechanisms, efficiently sending test traffic, and avoiding repeated analysis, greatly improving the efficiency of the testing system. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Other features, objects and advantages of the present application will become more apparent upon reading the detailed description of non-limiting embodiments made with reference to the following drawings: Figure 1 This is a schematic diagram of the structure of a browser-assisted Web application testing system provided by one embodiment of the present application; Figure 2 This is a timing flow chart of various parts of a browser-assisted Web application testing system provided by an embodiment of the present application; Figure 3 This is a flowchart of a browser-assisted Web application testing method provided in one embodiment of the present application. DETAILED DESCRIPTION

[0009] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0010] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The singular forms "a", "the" and "the" used in the embodiments of the present invention are also intended to include plural forms, unless the context clearly indicates other meanings.

[0011] An embodiment of the present invention provides a browser-assisted Web application testing system 100. The logical architecture of the system is shown in FIG. Figure 1 .

[0012] Testing system 100 includes a testing tool 101, a proxy server 102, a browser client 103, a target web application to be tested (e.g., a website), and a target server 104 for the target web application. Testing tool 101 can be an app or other software program used for website testing. Proxy server 102 logically sits between testing tool 101 and the browser client. Testing tool 101, the browser client, and the target web application to be tested can be installed on the same computer or on different computers.

[0013] The following is based on Figure 2 The timing logic shown in FIG. 1 is used to provide a detailed introduction to the functions of each component of the test system 100 .

[0014] The testing tool 101 is used to send a test request to the target server 104 of the target Web application and receive the response header and response content returned by the target server 104; analyze whether the target Web application has a JavaScript feature reference based on the response content, and analyze whether there is a dynamic field dependency based on the request content; if there is a JavaScript feature reference and / or a dynamic field dependency, generate tag data requiring browser-assisted testing, and save the tag data to a tag database corresponding to the target Web application; send a replay request of the test request to the proxy server 102, and perform defect logic detection of the target Web application based on the response data of the replay request forwarded by the proxy server 102.

[0015] The tag data includes the target web application's domain name, a list of JavaScript dynamic reference signatures, a dictionary containing various dynamic fields, a flag indicating whether to enable browser assistance, analysis time, and expiration date. This tag data can be used to determine whether browser assistance is required and to indicate which fields should be dynamically updated during a replay request. The tag data in this tag database is persistent and can be used as a basis for determining whether to enable browser assistance during each replay request, avoiding repeated analysis.

[0016] Furthermore, the testing tool 101 is further configured to identify all JavaScript scripts and referenced JavaScript files contained in the target web application through the response content, analyze whether the target web application includes frameworks and / or middleware with specific browser behavior dependencies through feature detection, and generate data indicating that browser-assisted testing is required if so; and compare whether there are differences in the response of the target web application when opened with a browser and when opened with a non-browser, and generate data indicating that browser-assisted testing is required if so. The testing tool 101 identifies JavaScript feature references using the two aforementioned methods. If any of the methods meets the requirements, it is determined that the replay request of the current target web application requires browser assistance, thereby updating the test request parameters based on the actual values ​​in the current browser environment.

[0017] Furthermore, the testing tool 101 is also used to detect whether the cookie contains dynamic feature components, analyze the generation pattern and update frequency of the cookie, and if the cookie contains dynamic feature components or is dynamically updated, generate marked data requiring browser-assisted testing; identify whether the request header contains a dynamic signature header and a timestamp header, and if so, generate marked data requiring browser-assisted testing; analyze whether the fields in the request header and request body have the same field names and field values ​​as the fields stored in the browser state repository localStorage, sessionStorage, and Window object, and if so, generate marked data requiring browser-assisted testing. The testing tool 101 identifies the dependencies of dynamic fields through the above three methods. When any of the methods meets the conditions, it can be determined that the replay request of the current target Web application requires browser assistance, so that the test request parameters can be updated according to the actual values ​​in the current browser environment.

[0018] The proxy server 102 is used to receive and analyze the replay request sent by the test tool 101. If the tag data exists in the tag database of the target web application targeted by the replay request, the proxy server 102 injects JavaScript code for processing the replay request into the browser instance of the target web application (an independent, running browser process and its related execution environment); receives response data of the replay request forwarded by the browser client 103, and forwards the response data to the test tool 101.

[0019] It's important to note that the injected JavaScript code is the specific processing logic for request replay. It's responsible for editing sent requests and processing received responses, thus fulfilling some of the proxy application's logic. JavaScript code is injected into the browser and executed on the web page to implement the processing logic.

[0020] The browser client 103 is used to receive and execute the JavaScript code, establish a WebSocket connection between the proxy server 102 and the browser instance, receive and parse the replay request forwarded by the proxy server 102 through the WebSocket connection, extract the dynamic fields of the current page of the browser instance and update the parameters of the dynamic fields, and initiate a real replay request to the target server 104 based on the updated dynamic field parameters; receive the response data of the replay request returned by the target server 104, and forward the response data to the proxy server 102.

[0021] Specifically, the browser client 103 parses the replay request, finds the latest value in the dynamic field association state library in the current browser instance according to the dynamic field recorded in the tag data, and replaces or supplements the corresponding field value in the replay request with the latest value, thereby realizing the update of dynamic field parameters.

[0022] It should be noted that the WebSocket connection is primarily used to implement bidirectional communication between the proxy server 102 and the browser client 103. This embodiment, based on WebSocket bidirectional communication and JavaScript injection, enables seamless collaboration between the proxy server 102 and the browser client 103, ensuring the correct processing of dynamic fields and successful execution of requests during traffic replay.

[0023] The target server 104 is configured to receive the test request and return a response header and response content of the test request to the test tool 101 ; receive a real replay request initiated by the browser client 103 , and return response data of the replay request to the browser client 103 .

[0024] Aiming at the needs of Web application testing, the present invention adopts a layered logic architecture design at the software level, which mainly includes the following core components: (1) Test target analysis and decision-making level Target Web application feature recognition module: automatically analyzes the JavaScript features and dynamic field dependencies of the test target; Dynamic Field Analyzer: Identifies and analyzes dynamic fields such as cookies, request headers, and local storage in target web applications. Target Web application tagging module: stores and manages the technical characteristics and processing strategy information of the target Web application being tested; (2) Test request proxy layer Test request interception module: intercepts all HTTP / HTTPS requests issued by test tools; Request replay classifier: classify and mark test requests, and select direct replay / browser-assisted replay; Test processing method selector: supports rule-specified or automatic selection of test processing methods; (3) Browser auxiliary testing layer On-demand browser manager: dynamically launches and manages browser test environments based on testing needs; Communication browser pool scheduling module: allocates browser resources based on test request characteristics; Request management module: provides a two-way communication channel between the test request agent and the browser; (4) Dynamic field processing layer (located in the browser) Dynamic field extraction module: extract dynamic field values ​​from local storage, cookies, and headers; Request parameter updater: updates the Header, Body, and Query parameters of the test request according to the dynamic field values; Response Modifier: Modify the test response content as needed.

[0025] This embodiment analyzes the dependencies between dynamic fields and request parameters by detecting features such as specific JavaScript library references, dynamic script loading, and key function calls, and by establishing a dynamic field analysis system that includes cookies, headers, and browser status libraries. This determines whether browser assistance is required, and establishes a tag database containing test target features. The persistent tag data in the tag database is used to determine whether browser assistance is required and to indicate which fields should be dynamically updated when replaying requests. The above measures of this embodiment enable replay requests to bypass the target server's protection mechanism, efficiently send the traffic to be tested, avoid repeated analysis, and greatly improve the efficiency of the test system.

[0026] See also Figure 3 Another embodiment of the present invention further provides a browser-assisted Web application testing method, which specifically includes the following steps: In step S101, the testing tool sends a test request to the target server of the target Web application and receives the response header and response content returned by the target server; analyzes whether the target Web application has a JavaScript feature reference based on the response content, and analyzes whether there is a dynamic field dependency based on the request content; if there is a JavaScript feature reference and / or a dynamic field dependency, generates tag data requiring browser-assisted testing, and saves the tag data to a tag database corresponding to the target Web application; and sends a replay request for the test request to the proxy server.

[0027] The purpose of this step is to analyze the JavaScript features and dynamic field dependencies of the target web application (e.g., website) under test. Based on the analysis results, it is determined whether the target web application requires browser-assisted testing and marked to provide processing strategy selection for subsequent test replay.

[0028] Exemplarily, a test request is sent to a test website, and the response content and HTTP request header information of the test request are analyzed, including: (1) Analyze all Javascript scripts and referenced Javascript files on the target website. These files may provide the same or even similar content to different websites due to factors such as frameworks and middleware, or have specific text features. Therefore, feature detection methods can be used to analyze whether the website contains specific frameworks and middleware. These frameworks and middleware have fixed browser behavior dependencies. By identifying these features, it can be directly determined that the website needs to use browser-assisted testing (i.e., browser-assisted testing requests).

[0029] (2) Detect the key response status of the website. Since the response of the target website is very different when it is opened by a browser and when it is opened by a non-browser (such as a bash command), by judging the degree of response difference, it is also possible to identify whether the target website needs browser-assisted testing.

[0030] (3) Detect whether the cookie contains dynamic feature components, analyze the generation pattern and update frequency of the cookie, and if the cookie contains dynamic feature components or the cookie is dynamically updated, generate mark data that requires browser-assisted testing. The principle of this method is that the browser will not update all fields in the request by default, and usually only updates the cookie. Therefore, once the cookie contains dynamic feature components or the cookie is dynamically updated, it indicates that the website needs browser-assisted testing.

[0031] (4) Identify whether there are dynamic signature headers and timestamp headers in the request header. If so, generate marker data that requires browser-assisted testing. The principle of this analysis method is that the browser needs to update the signature header and timestamp header in the request header. Once they are dynamically updated, it indicates that browser-assisted testing is required.

[0032] (5) Analyze whether the fields in the request header and request body have the same field names and field values ​​as the fields stored in the browser state library localStorage, sessionStorage, and Window object. If so, generate marker data that requires browser-assisted testing. The principle of this analysis method is: when the field names and field values ​​in the request header are the same as the browser storage or window object properties, it can be inferred that these values ​​may be automatically set or modified by the browser environment, that is, the browser automatically adds these request headers. Therefore, through the above analysis process, it can be determined whether the website requires browser-assisted testing.

[0033] Through the above five analysis and judgment methods, it is possible to determine whether a website requires browser assistance testing. If necessary, tag data is generated and saved in a local tag database corresponding to the website. It should be pointed out that the tag data includes: the domain name of the target Web application, a list of JavaScript dynamic reference features, a dictionary containing various dynamic fields, a tag indicating whether browser assistance is enabled, analysis time and validity period, etc. The tag data can be used to determine whether browser assistance is required and to indicate which fields should be dynamically updated when replaying the request. The tag data in these tag databases is persistent and can be used as a basis for querying and judging whether browser assistance is performed each time a request is replayed, thus avoiding repeated analysis.

[0034] The following is an example of the structure code of the website's markup data: { "target_domain": "testapp.example.com", "js_features": { "dynamic_cookies": true,}, "dynamic_fields": { "dynamic_headers":{"X-Signature":"localstorage_aKeySignature", "Authorization":"localstorage_session", …}, }, "recommended_strategy": "browser_assist_required", "last_analyzed": "2024-01-15T10:30:00Z" } After the above-mentioned preliminary analysis and marking process is completed, the testing tool can send a replay request of the test request to the proxy server.

[0035] Step S102: The proxy server receives and analyzes the replay request sent by the test tool. If the tag data exists in the tag database of the target Web application targeted by the replay request, the proxy server injects JavaScript code for processing the replay request into the browser instance of the target Web application.

[0036] Specifically, after receiving a replay request, the proxy server analyzes the tag data in the tag database for the website targeted by the replay request. If the tag data indicates that browser-assisted testing is required, the proxy server injects JavaScript code into the browser instance. This injected JavaScript code contains the specific processing logic for the request replay. It is responsible for editing the sent request and processing the received response. It also assumes some of the proxy application's logic and is executed on the website's webpage.

[0037] In step S103, the browser client receives and executes the JavaScript code, establishes a WebSocket connection between the proxy server and the browser instance, receives and parses the replay request forwarded by the proxy server through the WebSocket connection, extracts the dynamic fields of the current page of the browser instance and updates the parameters of the dynamic fields, and initiates a real replay request to the target server based on the updated dynamic field parameters.

[0038] Specifically, the browser client is used to open the browser instance of the website to execute the JavaScript code and establish a WebSocket connection between the proxy server and the browser instance. The WebSocket connection is mainly used to achieve two-way communication between the proxy server and the browser client. Based on WebSocket two-way communication and JavaScript injection, seamless collaboration between the proxy server and the browser client is achieved to ensure the correct processing of dynamic fields and the successful execution of requests during traffic replay. Specifically, the browser client parses the replay request, finds the latest value in the dynamic field associated state library in the current browser instance according to the dynamic fields recorded in the tag data, and replaces or supplements the corresponding field value in the replay request with the latest value.

[0039] Exemplarily, updating the parameters of a dynamic field includes the following steps: 1. Get all the tag data corresponding to the website. The dynamic field dictionary in the tag data contains all the fields that need to be dynamically updated; 2. Based on the names of all fields that need to be dynamically updated in the marked data, find the relevant fields in the replay request or determine the relevant fields that are missing in the replay request; 3. Find the latest value in the associated state library of the relevant field in the current browser environment; 4. Replace or supplement the corresponding field parameter value in the replay request.

[0040] Finally, a real replay request is initiated to the target server based on the updated dynamic field parameters.

[0041] In step S104 , the browser client receives the response data of the replay request returned by the target server and forwards the response data to the proxy server; the proxy server forwards the response data to the testing tool, and the testing tool performs defect logic detection of the target Web application based on the response data.

[0042] The above description is merely a preferred embodiment of the present invention. Those skilled in the art should understand that the scope of the present invention is not limited to technical solutions formed by specific combinations of the above-mentioned technical features. It also encompasses other technical solutions formed by any combination of the above-mentioned technical features or their equivalents, without departing from the above-mentioned disclosure. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in this invention.

Claims

1. A browser-assisted Web application testing method, characterized in that: The steps include: The testing tool sends a test request to a target server of a target web application and receives a response header and response content returned by the target server; analyzes the target web application based on the response content to determine whether there are JavaScript feature references, and analyzes the request content to determine whether there are dynamic field dependencies; if there are JavaScript feature references and / or dynamic field dependencies, generates tag data requiring browser-assisted testing, and saves the tag data into a tag database corresponding to the target web application; Sending a replay request of the test request to the proxy server; The proxy server receives and analyzes the replay request sent by the test tool, and if the tag data exists in the tag database of the target web application targeted by the replay request, injects JavaScript code for processing the replay request into the browser instance of the target web application; The browser client receives and executes the JavaScript code, establishes a WebSocket connection between the proxy server and the browser instance, receives and parses the replay request forwarded by the proxy server through the WebSocket connection, extracts the dynamic fields of the current page of the browser instance and updates the parameters of the dynamic fields, and initiates a real replay request to the target server based on the updated dynamic field parameters; The browser client receives the response data of the replay request returned by the target server, and forwards the response data to the proxy server; The proxy server forwards the response data to the testing tool, and the testing tool performs defect logic detection of the target Web application based on the response data.

2. A browser-assisted Web application testing method according to claim 1, characterized in that: Analyze the target web application based on the response content to see if there is a JavaScript feature reference, including: Identifying all JavaScript scripts and referenced JavaScript files contained in the target web application through the response content, analyzing whether the target web application contains a framework and / or middleware that has specific browser behavior dependencies through a feature detection method, and generating marked data requiring browser-assisted testing if so; Compare whether there is a response difference between the target web application when it is opened with a browser and when it is opened with a non-browser. If so, generate markup data requiring browser-assisted testing.

3. The browser-assisted Web application testing method according to claim 1, wherein: Analyze the request content to see if there are any dependencies on dynamic fields, including: Detect whether the cookie contains dynamic feature components, analyze the generation pattern and update frequency of the cookie, and if the cookie contains dynamic feature components or the cookie is dynamically updated, generate marked data that requires browser-assisted testing; Identify whether there are dynamic signature headers and timestamp headers in the request header, and if so, generate markup data that requires browser-assisted testing; Analyze whether the fields in the request header and request body have the same field names and field values ​​as the fields stored in the browser state library localStorage, sessionStorage, and Window object. If so, generate marked data that requires browser auxiliary testing.

4. A browser-assisted Web application testing method according to any one of claims 1 to 3, characterized in that: The tag data includes: the domain name of the target Web application, a JavaScript dynamic reference feature list, a dynamic field dictionary, a tag indicating whether to enable browser assistance, an analysis time, and an expiration date.

5. A browser-assisted Web application testing method according to claim 4, characterized in that: Extracting the dynamic fields of the current page of the browser instance and updating the parameters of the dynamic fields include: According to the dynamic field recorded in the tag data, the latest value in the dynamic field association state library is found in the current browser instance, and the corresponding field value in the replay request is replaced or supplemented with the latest value.

6. A browser-assisted Web application testing system, characterized in that: include: The test tool is used to send a test request to the target server of the target Web application and receive the response header and response content returned by the target server; Analyzing whether the target web application has a JavaScript feature reference based on the response content, and analyzing whether there is a dynamic field dependency based on the request content; if a JavaScript feature reference and / or a dynamic field dependency exists, generating tag data requiring browser-assisted testing, and saving the tag data to a tag database corresponding to the target web application; Sending a replay request of the test request to the proxy server, and performing defect logic detection of the target Web application based on response data of the replay request forwarded by the proxy server; The proxy server is configured to receive and analyze the replay request sent by the test tool, and if the tag data exists in the tag database of the target web application targeted by the replay request, inject JavaScript code for processing the replay request into the browser instance of the target web application; receiving response data of the replay request forwarded by the browser client, and forwarding the response data to the testing tool; The browser client is configured to receive and execute the JavaScript code, establish a WebSocket connection between the proxy server and the browser instance, receive and parse the replay request forwarded by the proxy server through the WebSocket connection, extract the dynamic fields of the current page of the browser instance and update the parameters of the dynamic fields, initiate a real replay request to the target server based on the updated dynamic field parameters, receive response data of the replay request returned by the target server, and forward the response data to the proxy server; The target server is configured to receive the test request and return a response header and response content of the test request to the test tool; Receive the real replay request initiated by the browser client and return the response data of the replay request to the browser client.

7. A browser-assisted Web application testing system according to claim 6, characterized in that: The test tool is also used to: Identifying all JavaScript scripts and referenced JavaScript files contained in the target web application through the response content, analyzing whether the target web application contains a framework and / or middleware that has specific browser behavior dependencies through a feature detection method, and generating marked data requiring browser-assisted testing if so; Compare whether there is a response difference between the target web application when it is opened with a browser and when it is opened with a non-browser. If so, generate markup data requiring browser-assisted testing.

8. A browser-assisted Web application testing system according to claim 6, characterized in that: The test tool is also used to: Detect whether the cookie contains dynamic feature components, analyze the generation pattern and update frequency of the cookie, and if the cookie contains dynamic feature components or the cookie is dynamically updated, generate marked data that requires browser-assisted testing; Identify whether there are dynamic signature headers and timestamp headers in the request header, and if so, generate markup data that requires browser-assisted testing; Analyze whether the fields in the request header and request body have the same field names and field values ​​as the fields stored in the browser state library localStorage, sessionStorage, and Window object. If so, generate marked data that requires browser auxiliary testing.

9. A browser-assisted Web application testing system according to any one of claims 6 to 8, characterized in that: The tag data includes: the domain name of the target Web application, a JavaScript dynamic reference feature list, a dynamic field dictionary, a tag indicating whether to enable browser assistance, an analysis time, and an expiration date.

10. A browser-assisted Web application testing system according to claim 9, characterized in that: The browser client is also used to: According to the dynamic field recorded in the tag data, the latest value in the dynamic field association state library is found in the current browser instance, and the corresponding field value in the replay request is replaced or supplemented with the latest value.

Images