Collaborative application testing

Patent metadata

Field	Value
Publication number	US-11301313-B2
Application number	US-201916553317-A
Country	US
Kind code	B2
Filing date	Aug 28, 2019
Priority date	Nov 7, 2012
Publication date	Apr 12, 2022
Grant date	Apr 12, 2022

Abstract

A method, computer program product, and computer system for performing, at a computing device, an analysis of a web application. A response is annotated by the web application with coverage data based upon, at least in part, the analysis, wherein the coverage data indicates which actions have been performed on the web application and which actions have not been performed on the web application according to results of the analysis. The response that includes the coverage data is shared with one or more users.

First claim

What is claimed is:

1. A computer-implemented method comprising:
performing, at a computing device, an analysis of a web application, wherein the analysis of the web application includes automatically injecting a test payload into the web application and validating whether the web application transitions into an illegal state;
receiving a request at the web application for the text payload;
creating, by the web application, a response to the request;
annotating the response to the test payload by the web application with coverage data in one or more fields of the response to the request based upon, at least in part, results of the analysis of the web application, wherein the coverage data indicates which actions have been actions performed by individual members of a collaborative group on the web application, including injection of the test payload, with the test coverage data, and which actions have not been performed on the web application, wherein the response includes one or more indications of coverage metrics, wherein the one or more indications of coverage metrics includes at least one of an indication of which client-side form has not mutated and would potentially lead to vulnerability, an indication of which web based transaction should be taken from the client-side form to reach a security-relevant form, and an indication of which input should be used to trigger a security vulnerability via a particular field of the one or more fields of the response to the request; and
sharing the response that includes the coverage data with one or more users.

2. The computer-implemented method of claim 1 wherein the response includes a Hypertext Markup Language response.

3. The computer-implemented method of claim 1 further comprising:
performing a second analysis of the web application;
annotating a second response by the web application with additional coverage data based upon, at least in part, results of the second analysis; and
sharing the second response with one or more users, wherein the second response includes the coverage data and the additional coverage data.

4. The computer-implemented method of claim 1 further comprising storing the coverage data at the computing device.

5. The computer-implemented method of claim 1 wherein the analysis includes static analysis.

6. The computer-implemented method of claim 1 wherein the response that includes the coverage data is shared with a user that did not initiate the analysis.

7. The computer-implemented method of claim 1 wherein the response that includes the coverage data is shared automatically based upon, at least in part, completing at least a portion of the analysis of the web application.

8. A computer program product residing on a non-transitory computer readable storage medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
performing an analysis of a web application, wherein the analysis of the web application includes automatically injecting a test payload into the web application and validating whether the web application transitions into an illegal state;
receiving a request at the web application for the text payload;
creating, by the web application, a response to the request;
annotating the response to the test payload by the web application with coverage data in one or more fields of the response to the request based upon, at least in part, results of the analysis of the web application, wherein the coverage data indicates which actions have been actions performed by individual members of a collaborative group on the web application, including injection of the test payload, with the test coverage data, and which actions have not been performed on the web application, wherein the response includes one or more indications of coverage metrics, wherein the one or more indications of coverage metrics includes at least one of an indication of which client-side form has not mutated and would potentially lead to vulnerability, an indication of which web based transaction should be taken from the client-side form to reach a security-relevant form, and an indication of which input should be used to trigger a security vulnerability via a particular field of the one or more fields of the response to the request; and
sharing the response that includes the coverage data with one or more users.

9. The computer program product of claim 8 wherein the response includes a Hypertext Markup Language response.

10. The computer program product of claim 8 wherein the operations further comprise:
performing a second analysis of the web application;
annotating a second response by the web application with additional coverage data based upon, at least in part, results of the second analysis; and
sharing the second response with one or more users, wherein the second response includes the coverage data and the additional coverage data.

11. The computer program product of claim 8 wherein the operations further comprise storing the coverage data at a computing device associated with the analysis.

12. The computer program product of claim 8 wherein the analysis includes static analysis.

13. The computer program product of claim 8 wherein the response that includes the coverage data is shared with a user that did not initiate the analysis.

14. The computer program product of claim 8 wherein the response that includes the coverage data is shared automatically based upon, at least in part, completing at least a portion of the analysis of the web application.

15. A computing system including a processor and a memory configured to perform operations comprising:
performing, at a computing device, an analysis of a web application, wherein the analysis of the web application includes automatically injecting a test payload into the web application and validating whether the web application transitions into an illegal state;
receiving a request at the web application for the text payload;
creating, by the web application, a response to the request;
annotating the response to the test payload by the web application with coverage data in one or more fields of the response to the request based upon, at least in part, results of the analysis of the web application, wherein the coverage data indicates which actions have been actions performed by individual members of a collaborative group on the web application, including injection of the test payload, with the test coverage data, and which actions have not been performed on the web application, wherein the response includes one or more indications of coverage metrics, wherein the one or more indications of coverage metrics includes at least one of an indication of which client-side form has not mutated and would potentially lead to vulnerability, an indication of which web based transaction should be taken from the client-side form to reach a security-relevant form, and an indication of which input should be used to trigger a security vulnerability via a particular field of the one or more fields of the response to the request; and
sharing the response that includes the coverage data with one or more users.

16. The computing system of claim 15 wherein the response includes a Hypertext Markup Language response.

17. The computing system of claim 15 wherein the operations further comprise:
performing a second analysis of the web application;
annotating a second response by the web application with additional coverage data based upon, at least in part, results of the second analysis; an

Assignees

• IBM

Inventors

• Segal Ory
• Saltzman Roi
• Tripp Omer

Classifications

• G06F11/3676 Primary

  for coverage analysis · CPC title

• G06F11/3668

  Testing of software · CPC title

• G06F11/0784 Primary

  Routing of error reports, e.g. with a specific transmission path or data flow · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F11/3604

  Analysis of software for verifying properties of programs (testing of software G06F11/3668) · CPC title