Driving IE Automation to put a file name into an <INPUT type="file">

[Phlip]

Newsgroupies:

I have this friend who is crazy about testing; he refuses to "just
write it", even for things as simple as HTML pages.

My friend wants to drive InternetExplorer's Automation model, thru
Perl, to test the server round-trip. But we are testing a CGI form
that you upload a file to.

The code starts IE as a COM (ActiveX, whatever) object. Then it
navigates to
a server (possibly a buggy one!).

The sub findField(type, name) finds an <INPUT> field of the given type
and
name.

We find the DOM object fronting this HTML:

<input size="72" value="" name="file" type="file">

Note the type is "file" - that creates the little "Browse" button that
lets
you

Then, we try to change the field's value attribute from nothing to a
sample
string...

# see http://samie.sourceforge.net for more examples of code like
this

use strict;
use warnings;
use Win32::OLE qw(EVENTS in);
use Win32:rocess;

our $IE;

sub StartIE {
$IE = Win32::OLE->new("InternetExplorer.Application") || die "Could
not
start Internet Explorer.Application\n";
$IE->{visible} = shift;
}


StartIE(1);
$IE->navigate("http://www.somewhere.com/cgi/service.cgi");

my $READYSTATE_COMPLETE = 4;

# while ($IE->{Busy} == 1)
until($IE->{ReadyState} == $READYSTATE_COMPLETE){
sleep(0.4);
}


my $IEDoc = $IE->{Document};

sub findField{
my $type = shift;
my $name = shift;
for (my $i=0; $i < $IEDoc->all->length; $i++) {
if ($IEDoc->all($i)->tagName =~/^FORM$/) {
my $form = $IEDoc->all($i);
for (my $q = 0; $q < $form->all->length; $q++)
{

if ($form->all($q)->tagName =~/^INPUT$/) {
my $input = $form->all($q);

if ($input -> {type} eq $type and
$input -> {name} eq $name )
{
return $input;
}
}
}
}
}
return undef;
}


my $fileField = findField('file', 'file');
print $fileField->type."\n";
print $fileField->name."\n";
print $fileField->value."\n";
$fileField->setAttribute('value', "hi mom");
print $fileField->value."\n";

....every thing there is predictable until after setAttribute(). Then,
the
value we push in is not there. When you visually inspect the page,
it's
still not there.

We can write on fields of type="text" with exactly the same notation
as above.

Switching to a legit filename instead of "hi mom" also doesn't work.

Please help me get my friend coding again instead of testing!

 

[Igor Tandetnik]

As a test purist, my friend could drive the keyboard like you say (as
could a cracker).

A cracker would first have to install on the user machine something
capable of calling raw Win32 API functions (a script on HTML page cannot
do that). Once the cracker manages to do that, typing into the edit
field in IE is probably the least of your worries.
--
With best wishes,
Igor Tandetnik

"For every complex problem, there is a solution that is simple, neat,
and wrong." H.L. Mencken