Testautomation in a restricted environment - security

I'm tasked with establishing a Testautomation (visit webapp, click buttons, check dropdown-contents, download pdfs, etc.). Unfortunately, the company system (Win 10) is very limited, even for local admins (I needed a separate install of chrome that allowed popups, I can't install firefox on my own etc.)
I did manage to download the standalone cypress.exe (download.cypress.io) and launch it. Of course, "This browser was not launched through Cypress. Tests cannot run." I was in the hopes the built in electron would bypass this, but choosing this, cypress gets stuck with "Your tests are loading..."
As this is way above my knowledge of system Security, I believe my only way is talking to my admin to "please, allow me X"
-> What do I need to do, to find out what "X" is, exactly? Which X will be most likely acceptable?

Related

How To ADD Firefox Default Applications

So I'm trying to find a way to add default file extensions options to Firefox. Since for whatever reason it doesn't give you the option?
Example: Settings > General > Applications
I want to add new content types and then be able to select my default application of choice.
The current issue is, that I use an MSP client that when necessary allows us to remote into a client's workstation for troubleshooting. Normally one would just click on the "Start Remote Session," button, and it brings up the application to do so. However, since it operates in some form of Javascript (I think....?), it doesn't technically download a file for me to save and then execute through the app. It just opens the app automatically. It never gives me the option to save the a file or anything like that, that it would use for the Remote Session app.
So I want to figure out how to bypass this issue by just adding the extension needed for this process in Firefox's default content types.
Works on Windows, I'm currently on Linux. (So please don't tell me to not use linux or any form there of. That or to use wine or playonlinux. I already am)

Chrome OS: how to enable direct SFTP access in the Files app / Pixelbook Review

An article on Chrome OS that I read here:
https://medium.com/#JamesCridland/review-five-months-with-a-chromebook-for-web-development-writing-and-more-8adf36b4a061
says:
"Update: Above, I mention that I use SSH and vi to do my programming work. And I did. Except I don’t any more. It turns out that one of the newer updates added direct SFTP access into the Files app (the equivalent of Explorer or Finder), so that my development box appears simply as another drive on my Chromebook. And Caret is an excellent programmer’s editor. So now I have a proper programmer’s editor (as well as the SSH terminal I need to put those changes live)."
Ok. But, when I go into Chrome OS's files app, the apparent way 'mount' my equiv of his
'development box' is via 'add new services', which is launching a webstore-app named 'SFTP' (whose icon is a blue folder outline with "SFTP" on it). i,e.:
https://chrome.google.com/webstore/detail/sftp-file-system/gbheifiifcfekkamhepkeogobihicgmn?hl=en
(My equiv of his 'development box' I'm assuming to be my web-server at bluehost.com, where I currently use Firefox's FireFTP extension, on Win-10.)
I can't get this 3-stars webstore 'SFTP' app (authored by someone from Japan) to authenticate me into my bluehost acc't. So, now I'm wondering whether
this 'SFTP' app is even the right thing to have installed, due to all the one- and two-star showstopper reviews. One typical review by a guy named Tim says:
"It's a nice try, but I really wish someone who knows what they're doing would make this service. It looks like it works but if you drill down more than a few folders deep on the remote filesystem, operations slow to a crawl."
Similarly, the two clients ('sFTP client' and 'sFTP client Lite) also have such low ratings, that my gut says that Google has failed to deliver a robust web-developer infrastructure.
Come on Google...you need to implement this stuff under your own logo.
Am I missing something???
Probably should advertise this functionality better :), but the Secure Shell App supports mounting via SFTP so it will appear in the Files app.
Steps to use:
Install Secure Shell Chrome extension.
Launch the extension (look for it in the bar to the right of the omnibox/browser URL bar -- it'll have a black terminal icon).
Enter the connection details to create a new profile.
Give it a description like "user#foo.com".
Instead of clicking "Connect" in the bottom right, click "Mount".
Authenticate with the server (keys/pass/whatever).
Once it finishes, it'll now be visible in the Files app.
If you suspend/resume the system or otherwise logout/reboot, you'll need to relaunch Secure Shell, select the saved profile, and then click "Mount" again. We probably should make this a bit smoother, but that's how it works currently.
No, not an answer yet...just more wishlist stuff:
Ok, more recent info about the Firefox browser's "FireFTP" addon:
It no longer works on the (new) std Firefox browser, as of a couple of
weeks ago when version 57.0 was released. (No biggie tho...a goggle revealed
a new-to-me browser called 'Waterfox' and it nicely supports FireFTP and the
other addons that Firefox dropped support for.)
So a bit more research yielded only yet more 'mumble-mode' confusion: it revealed that FireFTP is open source...located here:
https://github.com/mimecuvalo/fireftp
(So I submitted a new 'issue' there and asked about porting it to Chrome.)
I'm desperate, and recently test-drove Google's new Pixelbook.
(Sigh...nothing inspirational came of that...I give it one-thumb-down rating.
Here's my notes from that experience:
------------ Review notes of Pixelbook: ----------------------
Google didn’t think to include a USB-C to USB-A adapter. (A $2 item. e.g.)
https://www.amazon.com/Remax-USB3-1-Female-Adapter-Silver/dp/B01MCSRSKN/
That was my 'showstopper'...like a few other reviewers said...it's not well
thought out / matured. To me it feels more like a gimmick, than a product.
At a minimum, it rates my newest hashtag: #NRFPT (not ready for prime time).
I found no obvious way to disable the touchpad, when using a mouse.
In fact, no other reviewers expressed interest in using a mouse. (???)
Lastly, my favorite kind of Android apps are 'widgets', and I see no signs
that it has occurred to Google to allow Chrome-OS's desktop/background to
host any widgets.
Ok, I'm still in mumble-mode...and still in search of a FTP/SFTP GUI client for
the Chrome browser / Chrome-OS that is the quality of FireFTP.
Enable Linux(beta) on your chromebook. Then you can do whatever you want like on others linux machine.
A simple sftp connection command
sftp [user#]host
Enable linux and mount with sshfs
sudo apt install sshfs
then
sshfs -o reconnect,ServerAliveInterval=15,ServerAliveCountMax=3 user#xxx.xxx.xxx.xxx:/remotedir localdir
or with key auth
sshfs -o reconnect,ServerAliveInterval=15,ServerAliveCountMax=3,IdentityFile=~/.ssh/id_rsa user#xxx.xxx.xxx.xxx:/remotedir localdir
These will reconnect after resuming from sleep

Launch a local file with default file handler from chrome packaged app (or extension)

I'm building a launcher for internal use with a Chrome packaged app which includes links to internal resources (databases, web links, etc.).
The problem is with local files. I want them to launch using whatever program is the default handler for them. For example, access databases open in Access, etc.
I've tried:
Creating a file link file:///. Nothing happens in this scenario on click and the link is not followed.
I found an extension (locallinks) here: https://code.google.com/p/locallinks/, which will open local file links. I've tried borrowing from that extension and passing the file link to the background script in my packaged app which would then open a new window with that url. Unfortunately, that results in a file not found, even for simple types such as text files. So obviously the local filesystem is sandboxed. Not surprising.
I thought maybe it would work to pass the link to an extension to open, but in that case, the file would be opened in Chrome and if Chrome does not support it, it would attempt to download the file locally.
The reason I'm using Chrome Packaged Apps is:
1. This will be updated often and the Chrome Web Store update feature would make it easy to keep clients updated without having to build our own update mechanism.
2. We can restrict installation of the app through CWS to internal users.
3. The app would be used in a Windows, Linux and Mac environment. Obviously the file paths here would be different but since they would point to a samba share, and mount points and network share drive's are known this is an easy problem to overcome.
4. There is additional functionality we will be building into the Chrome app in the future other than the launcher which fits very well with how Chrome Apps are designed.
My thoughts are:
Native Client? I have read a bit about these, but I think I would end up with the same limitations where the native client app would be sandboxed and may not actually have any better way of launching a local file.
Sockets? Maybe a simple Qt app listening on a socket to launch apps? Since the Qt app would be run with user permissions, and the socket would only accept connections from localhost, I guess the socket could in theory be used by a non-privileged app to launch something with user-level permissions. Is there a way for me to limit connections through the socket to only be accessible from my extension?
The sockets solution isn't ideal but may work since the app would not be updated often (if ever) since functionality is so simple.
Am I missing an obvious way of doing this that wouldn't require another component (a Qt app?)
Relating to your thought #2, not sure what local installation footprint you are willing to tolerate, but you may consider:
Hosting a miniscule local web server, or Qt app as you mention, which can also launch local programs (any of those lightweight web server frameworks). Have your packaged app, or your own chrome extension rewrite links such that they point at your web server along with the url of the original link, which can easily launch whatever program. Downsides: this may cause bypassing some browser security screening of the original links in some forms of implementation.
You may also look at this stackoverflow question if it helps.
You can limit access by confirming the requests originate from the local machine, or by embedding a key or hash inside your chrome extension. You may generate the key upon installation so that it's unique per machine. None of this will pass very proper security scrutiny so it depends on your risk profile. You will have a hard time justifying how each part is secure and clean of exploitation attack potential.
It seems you will need both a chrome extension and a local miniscule web server to make this work. Maybe it's easier to let users just download the files and click them...
Sorry if this isn't help enough, but basically you are trying to do something that is by design not made possible in Chrome, so at this state of affairs there would likely not be a simple solution.

Connect to multiple remote machines to run automation scripts

I am an automation engineer where I need to run 450 CodedUI scripts on multiple machines. I have 15 machines on which I run these scripts.
To resolve my trouble I am using Microsoft's tool Remote Desktop Connection Manager to login to these machines. But I am getting the error on failed scripts that "Either the window is locked or minimized", but when I used to directly login to these machines and run the scripts there were no such issues.
I am unable to find any resolution. I tried one more tool to connect to 15 machines , i.e. AppVision tool as well. Even with that tool I am facing the errors on all my scripts that Some control is blocking the control to be clicked in.
I need to know if I can have any other tool or way where I would be able to login to the machines in one go and run automation scripts without any errors.
Any help is appreciated.
Thanks in adavance.
Coded UI requires that the screen saver is disabled on the remote machines.
Coded UI interacts with the desktop of the machine running the tests. When the screen saver is active it controls the desktop and, effectively, prevents Coded UI from interacting with the application under test.
The question refers to "Microsoft's tool Remote Desktop Connection Manager" so perhaps you are not using test agent software to run the test. Check this Microsoft web page and this Microsoft forum question for more details on how to set up remote computers to run Coded UI.

Is it possible for a team to use Eclipse installed on a shared network drive?

Our lead programmer likes to install tools on a shared network drive to minimize effort when updating. He recently installed Eclipse to the network drive, but when I run it, I get a window that says Workspace in use or cannot be created, choose a different one. After clicking OK, I get a window that gives me a drop down menu with only one item, the workspace on his machine. I can then browse to the workspace on my machine, click OK, and Eclipse continues to start up and run just fine. There's a check box in that second window that says Use this workspace as the default that I've checked after browsing and selecting my workspace, but the next time I start up Eclipse, it reverts back to the lead's workspace.
Are we violating some assumption that Eclipse makes about the install? We're on a Linux network, if it makes a difference.
Setup the shared eclipse such that it can not be modified by the users accessing it. This should (if I recall correctly) force eclipse into a "Shared User, Hands Off" mode and default to storing settings per user account.
Do not share Workspaces (or Projects) -- this will only break things horribly -- use a different strategy such as a proper revision control system.
Perhaps this documentation will be helpful.
"""The set up for this [shared] scenario requires making the install area read-only for regular users. When users start Eclipse, this causes the configuration area to automatically default to a directory under the user home dir. If this measure is not taken, all users will end up using the same location for their configuration area, which is not supported."""
I would try to run Eclipse locally as well as over the network. Using a shared network drive may make Eclipse more painful than it sometimes is. A development environment should work for the developer, even at the expense of a slightly more complicated setup.
Eclipse stores a lot of settings, including the workspace list, in it's installation directory (especially the "configuration" directory). It's hard to say how well sharing the installation will work, but I wouldn't be surprised if there were a number of issues caused by "fighting" between Eclipse instances running on different developer's workstations.
To fix the particular issue you're having, you could set up a separate startup script that passes your workspace as a command-line argument to Eclipse, bypassing the workspace selection dialog you're seeing.

Resources