Selenium script best practices

Veracode Dynamic Analysis or DAST Essentials supports Selenium scripts that you can use to crawl target web applications. This section provides best practices for recording and optimizing your crawl scripts.

See the example Selenium scripts.

When to use crawl scripts

You do not need a crawl script to perform a complete Dynamic Analysis or DAST Essentials scan of a web application. Create crawl scripts only if you need to access features or functionality in your web application that require specific inputs in a multistep process.

For example, a website might display different features depending on the region a user selects from a dropdown menu, or it might restrict access to certain features based on the data a user enters into a specific area of the application. You might also want to provide a crawl script to Dynamic Analysis or DAST Essentials if the results show that certain pages or functionality were not crawled.

A Dynamic Analysis or DAST Essentials scan can use heuristics to navigate an application. However, to fully understand the business logic around how data is exchanged between the database and the user interface, you must use crawl scripts or augment the analysis with Manual Penetration Testing.

General tips

• To ensure that a webpage finishes loading before interacting with it, such as signing in, include a wait command, such as waitForPageToLoad, at the beginning of the script.
• Always include a command in the script that validates successful sign in to the application. For example, waitForElementVisible. See Targeting elements and the example scripts.
• To find text that is visible on a webpage before successfully signing in, include a text verification command, such as assertTextPresent or verifyTextPresent, at the end of the script.
• Where possible, avoid including pauses in the script.
• Where possible, ensure each target in the script refers to the ID parameters in the HTML of each webpage. For example, "target": "id=username". See Targeting elements and the example scripts.

Remove pre-populated values

• Cache and cookies: Always clear your browser cache and cookies. If Dynamic Analysis or DAST Essentials is scanning a web application for the first time, it cannot use any information saved in cache, cookies, or local storage.
• Input fields: if the browser auto-populates any of the input fields, such as a username, Selenium does not record them in the script.

Targeting elements

• Input fields: the scan engine typically runs events on an input field while filling in the field. Adding additional mouse selections to the script, such as onFocus and onBlur events, is unnecessary and might cause problems.
• Multiple methods: if a step fails when the script executes, use an alternate method to identify targets.
• Elements with long waits: any command that targets an element, such as a mouse click or type command, automatically has an implicit waitForElementPresent process that runs with a 30-second timeout. If an element takes longer than 30 seconds to load, you might need to add additional waits. Veracode recommends adding these additional waits sparingly as they can increase your scan duration or cause other scan issues.

Recording sequence

When recording your script, Veracode recommends you use the following sequence in this order:

1. Open the webpage.
2. Wait for the sign in page to load.
3. Enter the username and password. If the username and password fields are on different pages, after entering the username, include a step, such as selecting Next on the page with the username field, to go to the next page, then enter the password.
4. Select Submit.
5. Wait for the next page to load and validate that a specific element is vislble.