Analysis and Testing of Ajax-based Single-page Web Applications

for DOM mutation events (W3C, a). The mutation event module was introduced
in DOM Level 2 and is designed to allow notification of document structural
changes, including attribute and text modifications. This way, by subscribing
to the mutation events, the crawler is automatically informed of DOM changes
and thus redundant DOM comparisons can be avoided, which in turn
increases the crawling performance. Another issue is coping with DOM changes
that are not directly caused by an event fired by the crawler, such as
pushed content from the server.
The dynamic user interface components and the huge combinations of click
trails in changing the state, makes modern web interfaces very challenging to
analyze and test. Atusa, currently detects and executes clickable elements
in a top-down, depth-first manner. This implies that first, the inferred state
machine is one possible instance of the state space, and second, the order
of the events could have an influence on the faults executed and detected.
How these parameters influence the effectiveness of the testing approach, and
whether click trails that mimic a web user’s actions would help the tool in
finding more relevant faults, are all questions that form possible extensions
of the work presented in this thesis. In addition, further work is needed to
explore possibilities of implementing useful and robust oracle comparators
and element identification mechanisms in the generated test cases (from the
state machine by Atusa) for conducting regression testing.
Testing modern web applications for security vulnerabilities is far from
trivial. Currently, we are exploring (Bezemer et al., 2009) ways Atusa can be
used to spot security violations in single-page web applications comprised
of various web widgets created by different developers. Generally, each web
widget should operate in its own environment. As any program code, widgets
can be used for malicious purposes. Security becomes an important aspect
when third-parties are allowed to build and include new widgets in public
catalogs. Example scenarios include when a malicious widget changes the
content of another widget to trick the user into releasing sensitive information,
or even worse, listens to the account details a user enters in another widget
(e.g., PayPal or Email widgets) and sends the data to a malicious site.
Automatically detecting security vulnerabilities such as Cross-Site Scripting
(XSS) (Wassermann and Su, 2008) and taking preventive measures by, for
instance, instrumenting the JavaScript code (Yu et al., 2007), in Ajax applications
are other interesting research areas that require more attention.
7.5 Concluding Remarks
The work presented in this dissertation aims at advancing the state-of-the-art
in comprehending, analyzing, and testing standards-based single-page web
applications, by means of a new architectural style, a significant set of techniques
and tools, and case study reports. These contributions are aimed at
helping software and web engineers better comprehend and deal with the
complexity of highly dynamic and interactive web systems.
162 7.5. Concluding Remarks