Verify that the API correctly handles cross-site scripting (XSS) attacks and returns the correct HTTP status code.
Language: Java
Framework: Rest assured
1//Assumptions - 2//1. API has a POST request for user registration that accepts username and password3//2. API has implemented a mechanism to detect and handle XSS attacks45import org.junit.jupiter.api.Test;6import static io.restassured.RestAssured.*;7import io.restassured.http.ContentType;89public class XSSAttackHandlingTest {10 11 @Test12 public void testXSSAttackHandling() {13 String username = "<script>alert('XSS Attack')</script>";14 String password = "password";1516 given().17 header("Content-Type", "application/json").18 body("{ \"username\": \"" + username + "\", \"password\": \"" + password + "\" }").19 when().20 post("/register").21 then().22 contentType(ContentType.JSON).23 assertThat().24 statusCode(200);25 26 //Assumption - If an XSS attack occurs, the API returns HTTP status code 40027 username = "<script>alert('XSS Attack')</script>";28 password = "<script>alert('XSS Attack')</script>";2930 given().31 header("Content-Type", "application/json").32 body("{ \"username\": \"" + username + "\", \"password\": \"" + password + "\" }").33 when().34 post("/register").35 then().36 contentType(ContentType.JSON).37 assertThat().38 statusCode(400);39 }40 41 //Code to connect to remote client with desired capabilities42 //Assumption - Remote client is running with Selenium server on port 444443 public void connectToRemoteClient() {44 DesiredCapabilities capabilities = new DesiredCapabilities();45 capabilities.setBrowserName("chrome");46 capabilities.setPlatform(Platform.WINDOWS);4748 WebDriver driver = new RemoteWebDriver(new URL("http://localhost:4444/wd/hub"), capabilities);49 }50}
Language: Javascript
1// Mocha and Chai.23//Assuming details about the API and environment: 4//The API is a RESTful web service that takes input through JSON format. 5//It is deployed on Amazon Web Services (AWS) and runs on an Amazon Elastic Compute Cloud (EC2) instance.67const chai = require('chai');8const expect = chai.expect;9const request = require('request');1011describe('API Testing for XSS Attack Handling', () => {12 it('should return status 200 if there is no XSS attack', (done) => {13 const requestBody = {14 "username": "testuser",15 "password": "testpassword"16 };17 const requestOptions = {18 url: 'http://<api-url>/login',19 method: 'POST',20 headers: {21 'Content-Type': 'application/json'22 },23 body: JSON.stringify(requestBody)24 };25 request(requestOptions, (error, response, body) => {26 expect(response.statusCode).to.equal(200);27 done();28 });29 });30 31 it('should return status 403 if there is an XSS attack', (done) => {32 const requestBody = {33 "username": "<script>alert('XSS Attack!');</script>",34 "password": "testpassword"35 };36 const requestOptions = {37 url: 'http://<api-url>/login',38 method: 'POST',39 headers: {40 'Content-Type': 'application/json'41 },42 body: JSON.stringify(requestBody)43 };44 request(requestOptions, (error, response, body) => {45 expect(response.statusCode).to.equal(403);46 done();47 });48 });49});5051//Remote client connection code with desired capabilities:5253//Assuming that the remote client is configured with desired capabilities to run tests on Safari browser with OS X El Capitan.5455const chai = require('chai');56const expect = chai.expect;57const webdriver = require('selenium-webdriver');58const remote = require('selenium-webdriver/remote');5960//set desired capabilities for Safari browser on OS X El Capitan61const capabilities = {62 browserName: 'safari',63 platformName: 'Mac OS X 10.11',64};6566//connect to remote client with desired capabilities67const driver = new webdriver.Builder()68 .usingServer('http://<remote-client-url>/wd/hub')69 .withCapabilities(capabilities)70 .build();7172//test case code73describe('API Testing for XSS Attack Handling', () => {74 it('should return status 200 if there is no XSS attack', async () => {75 const requestBody = {76 "username": "testuser",77 "password": "testpassword"78 };79 const requestOptions = {80 url: 'http://<api-url>/login',81 method: 'POST',82 headers: {83 'Content-Type': 'application/json'84 },85 body: JSON.stringify(requestBody)86 };87 const response = await driver.executeAsyncScript((requestOptions, callback) => {88 const xmlhttp = new XMLHttpRequest();89 xmlhttp.onreadystatechange = function() {90 if (xmlhttp.readyState == 4) {91 callback(xmlhttp.status);92 }93 };94 xmlhttp.open(requestOptions.method, requestOptions.url, true);95 xmlhttp.setRequestHeader('Content-Type', requestOptions.headers['Content-Type']);96 xmlhttp.send(requestOptions.body);97 }, requestOptions);98 expect(response).to.equal(200);99 });100 101 it('should return status 403 if there is an XSS attack', async () => {102 const requestBody = {103 "username": "<script>alert('XSS Attack!');</script>",104 "password": "testpassword"105 };106 const requestOptions = {107 url: 'http://<api-url>/login',108 method: 'POST',109 headers: {110 'Content-Type': 'application/json'111 },112 body: JSON.stringify(requestBody)113 };114 const response = await driver.executeAsyncScript((requestOptions, callback) => {115 const xmlhttp = new XMLHttpRequest();116 xmlhttp.onreadystatechange = function() {117 if (xmlhttp.readyState == 4) {118 callback(xmlhttp.status);119 }120 };121 xmlhttp.open(requestOptions.method, requestOptions.url, true);122 xmlhttp.setRequestHeader('Content-Type', requestOptions.headers['Content-Type']);123 xmlhttp.send(requestOptions.body);124 }, requestOptions);125 expect(response).to.equal(403);126 });127});128129//disconnect from remote client130driver.quit();
Disclaimer: Following code snippets and related information have been sourced from GitHub and/or generated using AI code generation tools. LambdaTest takes no responsibility in the accuracy of the code and is not liable for any damages.
Leverage LambdaTest’s cloud-based platform to execute your automation tests in parallel and trim down your test execution time significantly. Your first 100 automation testing minutes are on us.
Test Intelligently and ship faster. Deliver unparalleled digital experiences for real world enterprises.
Start Free Testing