Semi-automatic test method for automatic filling function of password manager

Abstract

The invention discloses a semi-automatic test method for an automatic filling function of a password manager, which comprises the following steps that: (1) a tester manually registers and logs in an account of the password manager, and stores a login certificate of a Web site in the password manager; then manually testing an automatic filling function of the password manager, and simultaneously marking a pixel range of a click position for triggering a rendering pop-up box and a pixel range of a click position for triggering an automatic filling operation; (2) configuring and starting an end-to-end test tool, then controlling a browser to access a Web site where the test case is located, and recording an actual filling result according to the pixel range marked in the step (1); and (3) comparing the actual filling result with an expected filling result of the test case, checking whether the actual filling result fills the form of the Web website according to the expected filling result or not, and generating a test report. According to the method, an automatic method and end-to-end testing are combined, and efficient testing of the automatic filling function of the password manager is achieved.

Description

Technical Field

[0001] The invention relates to the field of computers, and in particular to a semi-automatic testing method for an automatic filling function of a password manager. Background Art

[0002] In the modern Internet, web-based websites have become the core platform for netizens to conduct various online interactions and activities, providing netizens with a wealth of online services. In order to access these online services, users usually need to first create a website account. Subsequently, users can log in to the website and use the online services provided by the website. In the process of registering an account and logging in to the website, users must enter their personal information and login credentials (e.g., user name and password) in the registration and login forms provided by the website.

[0003] A password manager is a tool that helps users manage their login credentials. It usually provides services in the form of a built-in browser module or browser plug-in. The main function of this type of tool is to securely store user login credentials and automatically fill in login forms, thus playing a significant role in improving user experience and operational efficiency. Password managers save users' time by automatically filling in login forms provided by Web sites, so automatic form filling has become the preferred method for users to fill in website forms. However, the auto-fill function may cause errors in certain situations. For example, on some Web site pages, the password manager may not accurately identify the various fields of the login form, resulting in the password being incorrectly filled into the one-time authentication code or other inappropriate fields. These errors not only reduce the user experience, but also introduce security risks. Therefore, it is particularly important to systematically test the auto-fill function of the password manager.

[0004] At present, the test of the password manager's auto-fill function mainly adopts manual testing methods, which require the tester to first log in to the password manager account, visit the Web site, and trigger the password manager's auto-fill function in the website form. After automatically filling the website form, the tester needs to combine specific test cases and manually observe whether the password manager has filled the correct value into the appropriate website form field. For example, in the document "Huaman N, AmftS, Oltrogge M, et al. They would do better if they worked together: The case of interaction problems between password managers and websites [C] / / 2021 IEEE Symposium on Security and Privacy (SP). IEEE, 2021: 1367-1381.", the researchers analyzed the comments of users on the browser plug-in and GitHub platform to identify 39 problems in the password manager's auto-fill function in the website form. The researchers built a working example for each problem and used manual testing to evaluate whether 15 password managers can correctly fill the information stored in the password manager into the website form in different working examples. In order to provide concrete and intuitive evidence, the researchers recorded the test process to enhance the credibility and repeatability of the research conclusions. In general, the manual testing process is not only time-consuming, but also requires a lot of human resources when faced with a large number of website forms and multiple password managers that need to be tested. In addition, the auto-fill function involves many operational details. Due to the influence of human factors, the repeatability of the test is poor, and it is difficult to ensure the reliability of the test results. In addition, relying on methods such as recording videos for verification also requires additional manpower and time.

[0005] In addition, in the field of web site testing, end-to-end testing (E2E) is a widely used method to verify the functionality and performance of an application. End-to-end testing covers all interactive links from the front-end user interface to the back-end server by simulating the operation behavior of real users, ensuring that the application can operate normally in various usage scenarios. It allows testers to write automated scripts to simulate user operations in web sites, such as clicking buttons, filling out website forms, and browser website pages. However, traditional end-to-end testing tools are usually only used to test the web site itself, without involving browser plug-ins or other window handles of the current browser process (for example, the password manager built into the browser and the website page where the web site is located are different window handles of the same browser process). However, the automatic filling function of the password manager often relies on the new window handle generated by the browser or needs to be provided by the browser plug-in.

[0006] Therefore, developing an automated testing method for the auto-fill function of a password manager to improve the efficiency of the auto-fill function and reduce the consumption of human resources is an urgent problem that researchers in this field need to solve. Summary of the invention

[0007] In view of the deficiencies in the prior art, the technical problem to be solved by the present invention is to provide a semi-automatic testing method for the automatic filling function of a password manager.

[0008] The technical solution of the present invention to solve the technical problem is to provide a semi-automatic testing method for the automatic filling function of a password manager, characterized in that the method comprises the following steps:

[0009] Step 1, Initialization phase: The tester manually registers and logs in to the password manager account, and stores the login credentials of the Web site in the password manager; then manually tests the password manager's auto-fill function, and marks and records the pixel range of the click position that triggers the rendering of the pop-up box; then the password manager renders a pop-up box, and then marks and records the pixel range of the click position that triggers the auto-fill operation;

[0010] Step 2, automated testing phase: The tester configures and starts the end-to-end testing tool, starts the browser program, and then controls the browser to access the Web site where the given test case is located. According to the pixel range marked in step 1, the tester attempts to drive the password manager to fill the stored login credential data into the form of the Web site where the test case is located, and records the actual filling result;

[0011] Step 3, result comparison phase: The tester compares the actual filling result of step 2 with the expected filling result of the test case given in step 2, verifies whether the actual filling result of the password manager fills the form of the Web site according to the expected filling result, and generates a test report.

[0012] Compared with the prior art, the present invention has the following beneficial effects:

[0013] (1) The present invention uses an innovative automation method combined with the ability to operate the browser in an end-to-end test, especially the feature that the password manager plug-in provides an auto-fill function by adding a DOM element to the browser web page and being able to generate an interactive response with the browser (such as rendering a pop-up box). This achieves efficient testing of the password manager auto-fill function, reduces the time and cost of manual operation, and the impact of human factors on the test results, and ensures the repeatability of the test and the reliability of the test results.

[0014] (2) The present invention can avoid the influence of human factors, ensure that the environmental conditions and configurations of each test are consistent, and improve the repeatability and consistency of the test results.

[0015] (3) The present invention is controlled by a script program, and the test data is only transmitted and used in the test environment, thereby ensuring the security of the data.

[0016] (4) The present invention combines OCR and JavaScript technology to automatically extract the filling results and compare them with the expected results to generate a detailed test report. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is the overall flow chart of the present invention;

[0018] Figure 2 When the present invention triggers the automatic filling function of the password manager built into the Chrome browser, the pop-up box rendered by the password manager;

[0019] Figure 3 After the auto-fill function of the 1Password password manager is triggered for the present invention, the pop-up box rendered by 1Password contains the information stored by the tester in the password manager and the icon of the 1Password password manager;

[0020] Figure 4 This is a flow chart of the password manager automatically filling in a form after the automatic filling function of the password manager is triggered in the present invention. DETAILED DESCRIPTION

[0021] The specific embodiments of the present invention are given below. The specific embodiments are only used to further illustrate the present invention in detail and do not limit the protection scope of the present invention.

[0022] The present invention provides a semi-automatic testing method for the automatic filling function of a password manager (hereinafter referred to as the method), characterized in that the method comprises the following steps:

[0023] Step 1, Initialization phase: The tester manually registers and logs in to the password manager account, and stores the login credentials of the Web site in the password manager; then manually tests the password manager's auto-fill function, and marks and records the pixel range of the click position that triggers the rendering of the pop-up box; then the password manager renders a pop-up box, and then marks and records the pixel range of the click position that triggers the auto-fill operation;

[0024] Preferably, the specific steps of step 1 are as follows:

[0025] Step 11: The tester manually registers and logs in to the password manager account, and then stores the login credentials corresponding to the form of the Web site in the password manager;

[0026] Preferably, in step 11, the login credentials are the user name and password registered by the tester in the Web site.

[0027] Preferably, in step 11, the form is a standard Web login form that complies with OWASP and W3C standards, and includes input fields for user name and password and a submit button.

[0028] Preferably, in step 11, the Web site is a site that complies with OWASP and W3C standards.

[0029] Step 12: The tester uses the login credentials stored in step 11 to manually test the automatic filling function of the password manager: the tester first clicks the first input box in the form of the Web site to trigger the automatic filling function of the password manager, and marks the pixel range of the click position for rendering the pop-up box when the automatic filling function is triggered; after clicking, the password manager renders a pop-up box, in which the user name and the masked password of the login credentials stored in step 11 are marked (in this embodiment, such as Figure 2 As shown in the figure, a pop-up box is rendered for the password manager built into the Chrome browser);

[0030] Preferably, in step 12, the click position of the pop-up box is located at the password manager icon (such as Figure 3 As shown, the input box has the 1Password password manager icon at the end), or is located at any point inside the input box.

[0031] Step 13: In the pop-up box rendered in step 12, the tester manually marks the pixel range of the click position that triggers the password manager to automatically fill in the form of the Web site; when the tester clicks any point in the pixel range, the click operation will trigger the password manager to fill in the user login credential data stored in the password manager into the form of the Web site (in this embodiment, Figure 4 shown).

[0032] Step 2, automated testing phase: The tester configures and starts the end-to-end testing tool, starts the browser program, and then controls the browser to access the Web site where the given test case is located. According to the pixel range marked in step 1, the tester attempts to drive the password manager to fill the stored login credential data into the form of the Web site where the test case is located, and records the actual filling result;

[0033] Preferably, the specific steps of step 2 are as follows:

[0034] Step 21: The tester configures and starts the WebDriver of the end-to-end testing tool to generate a browser program, that is, to open the browser built into the end-to-end testing tool;

[0035] Preferably, in step 21, an end-to-end testing tool is used to perform automated testing of the auto-fill function, and the end-to-end testing tool is Selenium, Puppeteer or Playwright, preferably Selenium.

[0036] Preferably, in step 21, if the password manager running as a browser plug-in is tested, the corresponding browser plug-in needs to be additionally loaded when the browser is started.

[0037] Step 22: The tester controls the browser program generated in step 21 by writing code, accesses the website where the target test form in the given test case is located, locates the form of the test case's website, and clicks any position within the pixel range obtained in step 12, so that the password manager renders a pop-up box;

[0038] Preferably, in step 22, in order to ensure that the web site can be loaded successfully, the page of the web site is refreshed once using an end-to-end testing tool.

[0039] Step 23, after the password manager renders a pop-up box, the tester operates the end-to-end test tool to click any position within the pixel range obtained in step 13, and attempts to drive the password manager to fill the stored user login credential data into the form of the Web site where the test case is located; if the password manager does not fill any information or render any pop-up box in this attempt, the tester uses the end-to-end test tool to refresh the Web site and try again;

[0040] Step 24: When the password manager successfully fills in the fields of at least one Web site's form or fails to trigger the auto-fill function after no less than five attempts, the tester obtains the actual filling result of the password manager using the auto-fill function to fill in the form of the Web site where the test case is located in this round of testing.

[0041] Preferably, in step 24, the method for obtaining the actual filling result is a method combining JavaScript and OCR (Optical Character Recognition) technology: in the JavaScript-based method, the tester uses an end-to-end testing tool to run the code for obtaining the value of the field in the form of the Web site, accesses the DOM node and obtains the data of the target form field; when the JavaScript method is not applicable, that is, the form of the Web site sets a specific protection mechanism that does not allow the form's filling data to be obtained through JavaScript, the tester uses the end-to-end testing tool to take a screenshot of the Web site, and uses OCR technology to identify the actual filling result after triggering the automatic filling function of the password manager.

[0042] Step 3, result comparison phase: The tester compares the actual filling result of step 2 with the expected filling result of the test case given in step 2, verifies whether the actual filling result of the password manager fills the form of the Web site according to the expected filling result, stores the comparison result in the database and generates a test report.

[0043] Preferably, in step 3, the expected filling result is: the test case evaluates whether the password manager should fill the login credentials into the form of the Web website in the form of the Web website of a given test case according to the best practices of the security and usability of the password manager, and obtains the expected filling result; the best practices are security standards, industry standards, academic papers and national standards.

[0044] Preferably, the method also includes: step 4, test end stage: after completing the test, the tester closes the WebDriver that opens the end-to-end test tool in step 2 through a programming script, and releases all related resources; clears the browser cache and all temporary data, ensures that all initialization data and environment configurations have been reset, and ensures that the next test environment is consistent with the current round of test environment.

[0045] Any matters not described in the present invention are applicable to the prior art.

Claims

1. A semi-automatic testing method for the automatic filling function of a password manager, characterized in that: The method comprises the following steps: Step 1, Initialization phase: The tester manually registers and logs in to the password manager account, and stores the login credentials of the Web site in the password manager; then manually tests the password manager's auto-fill function, and marks and records the pixel range of the click position that triggers the rendering of the pop-up box; then the password manager renders a pop-up box, and then marks and records the pixel range of the click position that triggers the auto-fill operation; Step 2, automated testing phase: The tester configures and starts the end-to-end testing tool, starts the browser program, and then controls the browser to access the Web site where the given test case is located. According to the pixel range marked in step 1, the tester attempts to drive the password manager to fill the stored login credential data into the form of the Web site where the test case is located, and records the actual filling result; Step 3, result comparison phase: The tester compares the actual filling result of step 2 with the expected filling result of the test case given in step 2, verifies whether the actual filling result of the password manager fills the form of the Web site according to the expected filling result, and generates a test report.

2. The semi-automatic testing method of the automatic filling function of the password manager according to claim 1 is characterized in that: The specific steps of step 1 are as follows: Step 11: The tester manually registers and logs in to the password manager account, and then stores the login credentials corresponding to the form of the Web site in the password manager; Step 12, the tester uses the login credentials stored in step 11 to manually test the auto-fill function of the password manager: the tester first clicks the first input box in the form of the Web site to trigger the auto-fill function of the password manager, and marks the pixel range of the click position for rendering the pop-up box when the auto-fill function is triggered; after clicking, the password manager renders a pop-up box, in which the user name of the login credentials stored in step 11 and the password in the masked state are marked; Step 13. In the pop-up box rendered in step 12, the tester manually marks the pixel range of the click position that triggers the password manager to automatically fill in the form of the Web site; when the tester clicks any point in the pixel range, the click operation will trigger the password manager to fill in the user login credential data stored in the password manager into the form of the Web site.

3. The semi-automatic testing method of the automatic filling function of the password manager according to claim 2, characterized in that: In step 11, the login credentials are the user name and password registered by the tester on the Web site; The form is a standard web login form that complies with OWASP and W3C standards, containing input fields for username and password and a submit button.

4. The semi-automatic testing method of the automatic filling function of the password manager according to claim 2, characterized in that: In step 12, the click position of the pop-up box is located at the password manager icon displayed at the end of the first input box of the form of the Web site or at any point inside the input box.

5. The semi-automatic testing method of the automatic filling function of the password manager according to claim 2, characterized in that: The specific steps of step 2 are as follows: Step 21: The tester configures and starts the end-to-end testing tool to generate a browser program. Step 22: The tester controls the browser program generated in step 21, accesses the Web site where the given test case is located, locates the form of the Web site of the test case, and clicks any position within the pixel range obtained in step 12, so that the password manager renders a pop-up box; Step 23, after the password manager renders a pop-up box, the tester operates the end-to-end test tool to click any position within the pixel range obtained in step 13, and attempts to drive the password manager to fill the stored user login credential data into the form of the Web site where the test case is located; if the password manager does not fill any information or render any pop-up box in this attempt, the tester uses the end-to-end test tool to refresh the Web site and try again; Step 24: When the password manager successfully fills in the fields of at least one Web site's form or fails to trigger the auto-fill function after no less than five attempts, the tester obtains the actual filling result of the password manager using the auto-fill function to fill in the form of the Web site where the test case is located in this round of testing.

6. The semi-automatic testing method of the automatic filling function of the password manager according to claim 5, characterized in that: In step 21, if the password manager running as a browser plug-in is tested, the corresponding browser plug-in needs to be additionally loaded when the browser is started.

7. The semi-automatic testing method of the automatic filling function of the password manager according to claim 5, characterized in that: In step 22, in order to ensure that the web site can be loaded successfully, the page of the web site is refreshed once using an end-to-end testing tool.

8. The semi-automatic testing method of the automatic filling function of the password manager according to claim 5, characterized in that: In step 24, the method for obtaining the actual filling result is a method that combines JavaScript and OCR technology: in the JavaScript-based method, the tester uses an end-to-end testing tool to run the code for obtaining the value of the field in the form of the Web site, accesses the DOM node and obtains the data of the target form field; when the JavaScript method is not applicable, that is, the form of the Web site has set a specific protection mechanism that does not allow the form's filling data to be obtained through JavaScript, the tester uses the end-to-end testing tool to take a screenshot of the Web site, and uses OCR technology to identify the actual filling result after triggering the automatic filling function of the password manager.

9. The semi-automatic testing method of the automatic filling function of the password manager according to claim 1, characterized in that: In step 3, the expected filling result is: the test case evaluates whether the password manager should fill the login credentials into the form of the Web website in the given test case based on the best practices of the password manager's security and usability, and obtains the expected filling result; the best practices are security standards, industry standards, academic papers and national standards.

10. The semi-automatic testing method of the automatic filling function of the password manager according to claim 1, characterized in that: The method also includes: Step 4, test end stage: after completing the test, the tester closes the end-to-end test tool opened in Step 2 and releases all related resources; clears the browser cache and all temporary data, ensures that all initialization data and environment configurations have been reset, and ensures that the next test environment is consistent with the current round of test environment.

Images