White Box Testing: Types, Methods, and Android Apps

Introduction to White Box Testing

The testing of a software application's internal infrastructure and coding is referred to as white box testing. White box testing is also called open box testing, clear box testing, transparent box testing, glass box testing, structural testing, or code-based testing [1]. White box testing primarily focuses on the internal structure, design, and implementation of the software, with the aim of strengthening security, improving design and usability, and examining the flows of input and output within the application.

When using this approach, the tester concentrates on how the software performs what it is supposed to perform. In order to conduct white box testing, a tester must have programming knowledge so that they can understand the code used within the software and its implementation. This is because the tester goes beyond the user interface and into the detailed workings of the application. During white box testing, the tester examines which lines of code are being executed and which are not. If a line of code is not being executed, it may indicate missing logic or a typographical error that could lead to negative consequences. This method is referred to as white box testing because the software application, from the tester's perspective, is like a transparent or white box — one can clearly see what is happening inside.

There are two types of testing that software undergoes: white box testing and black box testing. Black box testing is conducted from an end-user perspective. The names were coined based on the view the tester has when performing each type of test. Black box testing does not allow the tester to see the inside of the software; rather, the tester interacts only with the end-user side. Having both types of testing ensures that the software is rigorously tested before it is launched and that any issues discovered can be resolved.

Performing White Box Testing

When conducting white box testing, the tester checks the software for:

• Internal security holes.
• Flow of specific inputs.
• Poorly structured paths.
• Expected outputs.
• Conditional loop functionality.
• Each object, statement, and function individually.

The tester conducts testing at the system, integration, and unit levels of the software. The aim of white box testing is to verify the working flow of the software or application [2]. The tester uses predefined inputs to check for expected outputs; if a predefined input produces an unexpected output, the tester knows there is a bug.

The first step in white box testing is understanding the code. The tester must learn and understand the software's source code, and since white box testing involves examining the inner workings of the software, the tester must have knowledge of the programming language used. Secure coding practices should be at the forefront of the tester's mind. The tester must be able to identify any security issues and prevent attacks, because the primary objective of white box testing is securing the software. The tester must also verify that a user cannot — knowingly or unknowingly — inject malicious code into the application.

The second step is creating and executing test cases [3]. The tester checks the software's code for proper structure and flow. One approach is writing additional code to test the software's source code. For each process in the application, the tester develops small tests aimed at checking how that process works. This step is primarily performed by the developer because it requires intimate knowledge of the code.

Types of White Box Testing

There are three main types of white box testing:

• Unit testing.
• Integration testing.
• Regression testing.

Unit Testing

A unit test is a level of software testing that examines individual components of a software system. The aim of unit testing is to validate whether each component, or unit, is performing as expected. A component is considered the smallest testable part of a software system, typically having minimal inputs and a single output. Unit testing is normally the first type of testing performed on software, and it is carried out by the programmer or developer as the code is being written. The developer writes some lines of code, a function, or an object, and then tests it to determine whether it is working correctly before moving on [4]. Conducting unit tests allows bugs to be identified and fixed early in the development process, making them easier and cheaper to resolve.

Unit testing may seem time-consuming, but in the long run it proves more reliable than ad hoc developer tests. Testing individual components makes it easier to reuse code with confidence that it will work, and this reduces overall coding time. Conducting unit testing during ongoing development also simplifies troubleshooting, because only the most recent changes need to be examined when a bug appears.

A useful analogy is the manufacture of a ballpoint pen. Each component — the cap, body, ink cartridge, ballpoint, and tail — is manufactured separately and checked individually to establish whether it works as expected. Once a component has been manufactured and tested, only those that pass move on to the next stage of assembly. The same principle applies to unit testing in software development.

Conclusion

It is vital that a software application be thoroughly checked for any coding errors that might result in the application being compromised or infected with malicious code. The primary goal of white box testing is to verify the security and integrity of the application; using this method, the developer or tester can examine the application's code and determine which lines are working correctly and which contain bugs or should be removed. Without rigorous testing, applications would ship with numerous faults and would fail to perform or complete tasks as expected.

It is therefore essential that an application be critically analyzed and tested to confirm that it has no faults and produces the desired results. Developers working on Android applications should be aware of the differences in testing and development that the platform presents and be prepared to adapt accordingly. Testing on the Android platform is broadly similar to testing on other software development platforms, but developers must make use of the platform-specific tools that allow them to simulate or run the application as if it were running on an actual device.

References

[1] T. Ostrand, "White-Box Testing," Encyclopedia of Software Engineering, 2002.

[2] M. E. Khan, "Different approaches to white box testing technique for finding errors," International Journal of Software Engineering and Its Applications, vol. 5, pp. 1–14, 2011.

[3] C. Bartolini, A. Bertolino, S. Elbaum, and E. Marchetti, "Bringing white-box testing to service oriented architectures through a service oriented approach," Journal of Systems and Software, vol. 84, pp. 655–668, 2011.

[4] Y. Cheon and G. T. Leavens, "A simple and practical approach to unit testing: The JML and JUnit way," in European Conference on Object-Oriented Programming, 2002, pp. 231–255.

[5] P. C. Jorgensen and C. Erickson, "Object-oriented integration testing," Communications of the ACM, vol. 37, pp. 30–38, 1994.

[6] S. Yoo and M. Harman, "Regression testing minimization, selection and prioritization: a survey," Software Testing, Verification and Reliability, vol. 22, pp. 67–120, 2012.

[7] R. Mahmood, N. Esfahani, T. Kacem, N. Mirzaei, S. Malek, and A. Stavrou, "A whitebox approach for automated security testing of Android applications on the cloud," in Automation of Software Test (AST), 2012 7th International Workshop on, 2012, pp. 22–28.