Bypass Testing of Web Applications

TLDR

Web applications often rely on client‑side input validation, which can be bypassed by end users, compromising data security and system integrity. The study develops a bypass testing strategy to generate client‑side tests that intentionally violate explicit and implicit input validation checks. The authors define specific rules and adequacy criteria for such tests and implement a proof‑of‑concept automated tool. Initial empirical results demonstrate the effectiveness of bypass testing in uncovering validation weaknesses.

Abstract

Web software applications are increasingly being deployed in sensitive situations. Web applications are used to transmit, accept and store data that is personal, company confidential and sensitive. Input validation testing (IVT) checks user inputs to ensure that they conform to the program's requirements, which is particularly important for software that relies on user inputs, including Web applications. A common technique in Web applications is to perform input validation on the client with scripting languages such as JavaScript. An insidious problem with client-side input validation is that end users can bypass this validation. Bypassing validation can cause failures in the software, and can also break the security on Web applications, leading to unauthorized access to data, system failures, invalid purchases and entry of bogus data. We are developing a strategy called bypass testing to create client-side tests for Web applications that intentionally violate explicit and implicit checks on user inputs. This paper describes the strategy, defines specific rules and adequacy criteria for tests, describes a proof-of-concept automated tool, and presents initial empirical results from applying bypass testing.