selenium security scanner by @gwestr
"perfect" testing pyramid
so, looking at a new functionality/feature, what kind of test design do we need? long term test coverage? at salesforce scale, UI tests get expensive - resources and time
what if we test without the DOM? can we have the devs write javascript tests?
test without DOM, load scripts and specs into javascript, execute them in the context of different browsers. these can be run much, much faster than webdriver UI tests.
"arrange", "act", "assert" pattern. but it's hard, what to do about dependencies?
mock everything except for what you're testing. don't test things nearby, just test specific things
javascript is application code!
bottom: JS unit tests, middle: work with headless DOM like Phantom.js, top: webdriver for ensuring consistent experience and browser compatibility
we want to find problems with active and passive scans
if you have selenium covering your entire app, you can use it to do security scans
how: send your selenium traffic through a proxy request and make a queue of requests, then with that list you potentially have all your access points/vulnerabilities
XSS (reflected or stored) (in the server or in the DOM), CSRF
CSRF tokens expire on replayed requests (which is working as expected, right? :))
failures and flappers can give a bad queue of requests that source your "entire list" of access points
not timely - you basically run your whole thing twice. once to collect, again to scan security
But, despite these things, it's really powerful if we can pull it into the CI loop,