Risk-based testing in Testing Fundamentals - Build an Automation Script

Risk-based testing for login functionality

Preconditions (2)

Step 1: Identify high-risk areas: login page and authentication process

Step 2: Test login with valid username and password

Step 3: Test login with invalid username

Step 4: Test login with invalid password

Step 5: Test login with empty username and password fields

Step 6: Test login with SQL injection attempt in username field

Step 7: Test login with very long input in username and password fields

✅ Expected Result: Login succeeds only with valid credentials; all invalid or malicious inputs are rejected with appropriate error messages; no system crashes or security breaches occur

Automation Requirements - Selenium with Python

Assertions Needed:

Verify successful login redirects to dashboard URL

Verify error message is displayed for invalid username

Verify error message is displayed for invalid password

Verify error message is displayed for empty fields

Verify error message is displayed for SQL injection attempt

Verify error message is displayed for very long inputs

Best Practices:

Use explicit waits to handle page loading

Use Page Object Model to separate page locators and actions

Use descriptive assertion messages

Avoid hardcoded waits like sleep

Use meaningful locators (id, name, or accessible attributes)

Automated Solution

Testing Fundamentals

from selenium import webdriver
from selenium.webdriver.common.by import By
from selenium.webdriver.support.ui import WebDriverWait
from selenium.webdriver.support import expected_conditions as EC
import unittest

class LoginPage:
    def __init__(self, driver):
        self.driver = driver
        self.username_input = (By.ID, 'username')
        self.password_input = (By.ID, 'password')
        self.login_button = (By.ID, 'loginBtn')
        self.error_message = (By.ID, 'errorMsg')

    def enter_username(self, username):
        self.driver.find_element(*self.username_input).clear()
        self.driver.find_element(*self.username_input).send_keys(username)

    def enter_password(self, password):
        self.driver.find_element(*self.password_input).clear()
        self.driver.find_element(*self.password_input).send_keys(password)

    def click_login(self):
        self.driver.find_element(*self.login_button).click()

    def get_error_message(self):
        return self.driver.find_element(*self.error_message).text

class TestRiskBasedLogin(unittest.TestCase):
    def setUp(self):
        self.driver = webdriver.Chrome()
        self.driver.get('https://example.com/login')
        self.wait = WebDriverWait(self.driver, 10)
        self.login_page = LoginPage(self.driver)

    def tearDown(self):
        self.driver.quit()

    def test_valid_login(self):
        self.login_page.enter_username('user1')
        self.login_page.enter_password('Password123!')
        self.login_page.click_login()
        self.wait.until(EC.url_contains('/dashboard'))
        self.assertIn('/dashboard', self.driver.current_url, 'Dashboard URL not loaded after valid login')

    def test_invalid_username(self):
        self.login_page.enter_username('wronguser')
        self.login_page.enter_password('Password123!')
        self.login_page.click_login()
        self.wait.until(EC.visibility_of_element_located(self.login_page.error_message))
        error = self.login_page.get_error_message()
        self.assertIn('Invalid username', error, 'Error message for invalid username not shown')

    def test_invalid_password(self):
        self.login_page.enter_username('user1')
        self.login_page.enter_password('WrongPass!')
        self.login_page.click_login()
        self.wait.until(EC.visibility_of_element_located(self.login_page.error_message))
        error = self.login_page.get_error_message()
        self.assertIn('Invalid password', error, 'Error message for invalid password not shown')

    def test_empty_fields(self):
        self.login_page.enter_username('')
        self.login_page.enter_password('')
        self.login_page.click_login()
        self.wait.until(EC.visibility_of_element_located(self.login_page.error_message))
        error = self.login_page.get_error_message()
        self.assertIn('Username and password required', error, 'Error message for empty fields not shown')

    def test_sql_injection_attempt(self):
        self.login_page.enter_username("' OR '1'='1")
        self.login_page.enter_password('Password123!')
        self.login_page.click_login()
        self.wait.until(EC.visibility_of_element_located(self.login_page.error_message))
        error = self.login_page.get_error_message()
        self.assertIn('Invalid username', error, 'Error message for SQL injection attempt not shown')

    def test_very_long_input(self):
        long_input = 'a' * 500
        self.login_page.enter_username(long_input)
        self.login_page.enter_password(long_input)
        self.login_page.click_login()
        self.wait.until(EC.visibility_of_element_located(self.login_page.error_message))
        error = self.login_page.get_error_message()
        self.assertIn('Input too long', error, 'Error message for very long input not shown')

if __name__ == '__main__':
    unittest.main()

The code uses Selenium with Python's unittest framework to automate risk-based testing of the login page.

The LoginPage class follows the Page Object Model pattern, storing locators and actions for the login page. This keeps the test code clean and maintainable.

Each test method targets a specific risk identified in the manual test case: valid login, invalid username, invalid password, empty fields, SQL injection attempt, and very long inputs.

Explicit waits (WebDriverWait) ensure the test waits for page elements or URL changes before asserting, avoiding flaky tests.

Assertions check for correct URL or error messages with clear messages to help diagnose failures.

The setup and teardown methods open and close the browser for each test, ensuring a fresh start.

Common Mistakes - 4 Pitfalls

Using time.sleep() instead of explicit waits

Using brittle XPath selectors that break easily

Mixing test logic and page locators in the same code

{'mistake': 'Not verifying error messages for invalid inputs', 'why_bad': "Missing verification means you don't know if the system handles errors properly.", 'correct_approach': 'Assert that appropriate error messages appear for each invalid input.'}

Bonus Challenge

Now add data-driven testing with 3 different sets of invalid credentials to verify error handling.

Show Hint

Practice

1. What is the main goal of risk-based testing in software testing?

easy

A. To avoid testing parts that are easy to test

B. To test all parts of the software equally

C. To focus testing on the most important and risky parts first

D. To test only the user interface

Solution

1. Step 1: Understand the purpose of risk-based testing

   Risk-based testing aims to prioritize testing efforts on areas with the highest risk to save time and improve effectiveness.

2. Step 2: Compare options with this purpose

   To focus testing on the most important and risky parts first matches this goal by focusing on important and risky parts first, while others do not.

3. Final Answer:

   To focus testing on the most important and risky parts first -> Option C

4. Quick Check:

   Risk-based testing = Focus on risky parts first [OK]

Hint: Risk-based testing targets risky parts first [OK]

Common Mistakes:

• Thinking all parts are tested equally
• Believing risk-based testing ignores important parts
• Confusing risk-based testing with UI-only testing

2. Which of the following is the correct way to prioritize tests in risk-based testing?

easy

A. By combining the impact and likelihood of potential problems

B. By testing the easiest features first

C. By testing features in alphabetical order

D. By testing only the newest features

Solution

1. Step 1: Recall how risk is calculated in testing

   Risk is usually calculated by combining the impact of a problem and how likely it is to happen.

2. Step 2: Match this with the options

   By combining the impact and likelihood of potential problems correctly states this combination, while others focus on unrelated criteria.

3. Final Answer:

   By combining the impact and likelihood of potential problems -> Option A

4. Quick Check:

   Risk = Impact x Likelihood [OK]

Hint: Prioritize tests by impact and likelihood [OK]

Common Mistakes:

• Prioritizing by ease or alphabetical order
• Ignoring likelihood of problems
• Testing only new features without risk analysis

3. Consider this simplified risk table for features:

Feature A: Impact=5, Likelihood=4
Feature B: Impact=3, Likelihood=6
Feature C: Impact=4, Likelihood=2

Which feature should be tested first based on risk?

medium

A. Feature B

B. Feature A

C. Feature C

D. All features equally

Solution

1. Step 1: Calculate risk for each feature

   Risk = Impact x Likelihood.
   Feature A: 5 x 4 = 20
   Feature B: 3 x 6 = 18
   Feature C: 4 x 2 = 8

2. Step 2: Identify highest risk

   Feature A has the highest risk score (20), so it should be tested first.

3. Final Answer:

   Feature A -> Option B

4. Quick Check:

   Highest risk = Feature A (20) [OK]

Hint: Multiply impact and likelihood to find highest risk [OK]

Common Mistakes:

• Choosing feature with highest likelihood only
• Ignoring impact in calculation
• Testing all features equally without prioritization

4. A tester wrote this pseudocode to select features to test based on risk:

features = [{"name": "A", "impact": 5, "likelihood": 4},
            {"name": "B", "impact": 3, "likelihood": 6}]

for feature in features:
    risk = feature["impact"] + feature["likelihood"]
    if risk > 8:
        print(feature["name"])

What is wrong with this code for risk-based testing?

medium

A. Risk should be calculated by multiplying impact and likelihood, not adding

B. The loop should use feature.name instead of feature["name"]

C. The risk threshold should be less than 8, not greater

D. The features list should be sorted before looping

Solution

1. Step 1: Review risk calculation method

   Risk-based testing calculates risk by multiplying impact and likelihood, not adding them.

2. Step 2: Identify error in code

   The code adds impact and likelihood, which is incorrect for risk calculation.

3. Final Answer:

   Risk should be calculated by multiplying impact and likelihood, not adding -> Option A

4. Quick Check:

   Risk = Impact x Likelihood, not sum [OK]

Hint: Risk = impact x likelihood, not sum [OK]

Common Mistakes:

• Adding instead of multiplying impact and likelihood
• Confusing dictionary access syntax
• Assuming sorting is required before risk check

5. You have three features with these risk scores:

Feature X: 12
Feature Y: 20
Feature Z: 20

Due to limited time, you can only test two features. Which is the best risk-based testing approach?

hard

A. Test Feature X and Feature Y because X has the lowest risk

B. Test all three features equally

C. Test Feature X and Feature Z because Z is newer

D. Test Feature Y and Feature Z because they have the highest risk

Solution

1. Step 1: Identify features with highest risk

   Feature Y and Feature Z both have the highest risk score of 20.

2. Step 2: Prioritize testing based on risk and time limit

   Since only two can be tested, choose the two with highest risk to maximize risk coverage.

3. Final Answer:

   Test Feature Y and Feature Z because they have the highest risk -> Option D

4. Quick Check:

   Test highest risk features first [OK]

Hint: Pick features with highest risk scores first [OK]

Common Mistakes:

• Testing lower risk features first
• Ignoring risk scores when time is limited
• Trying to test all features equally despite limits