Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Intelligence View
⚡ tsecurity.de Intelligence

XPath & CSS Selectors

During QA, some testers have to write automated tests. When this happens, it becomes important to find the element on the page for which the action needs to be performed (this could be a click, swipe, etc.). But it is not enough to simply…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

During QA, some testers have to write automated tests. When this happens, it becomes important to find the element on the page for which the action needs to be performed (this could be a click, swipe, etc.).



But it is not enough to simply find the element in the DOM, it is also important to find the correct path to this element, since a correctly selected path to this element is the key to successful stable selectors.



In this post, we will look at two main types: Xpath and CSS.






What Are Selectors?



Selectors are patterns used to identify elements in the DOM (Document Object Model). Think of them as precise directions that tell your automation tool: "Click here," "Type there," or "Check this."



Without good selectors, your tests become flaky and unreliable.






CSS Selectors



CSS (Cascading Style Sheets) selectors are primarily designed for styling, but testers use them to locate elements efficiently.



Advantages:




  • Clean and readable syntax

  • Fast in execution across most browsers

  • Well supported by testing frameworks like Cypress and Playwright



Common Examples:




/* By element */

button { }



/* By class */

.button-primary { }



/* By ID */

#login-input { }



/* By attribute */

input[type="email"] { }



/* Nested selector */

form#signup input.password { }







XPath Selectors



XPath (XML Path Language) comes from the XML world but is widely used in test automation for navigating complex DOM trees.



Advantages:




  • Extremely powerful - can traverse both forward and backward in DOM

  • Allows searching by text content (great for dynamic UIs)

  • Works even when attributes/classes are inconsistent



Common Examples:




/* By element */

//button



/* By attribute */

//input[@id='login-input']



/* By text */

//button[text()='Submit']



/* By hierarchy */

//div[@class='form']//input[@type='password']







CSS vs XPath - Which Should You Use?



Readability:





  • CSS Selector: Simple, concise


  • XPath: Verbose



Performance:





  • CSS Selector: Usually faster


  • XPath: Slightly slower



By Text:





  • CSS Selector: Not supported


  • XPath: Supported



Traversal (parent/child/sibling):





  • CSS Selector: Limited


  • XPath: Very powerful






Advices for QA:




  • Start with CSS selectors (cleaner, faster, easier).

  • Use XPath only when CSS isn't enough (e.g., text-based search or tricky DOM structures).






Best Practices for QA Engineers




  • Prefer unique IDs or data-test attributes for selectors whenever possible.

  • Avoid selectors like nth-child() - they often break after UI changes.

  • Collaborate with developers to introduce test-friendly attributes (data-testid, qa-id).

  • Keep selectors centralized in your test framework for easy maintenance.






Additional advice



In modern frameworks like Playwright, you can mix strategies:




// Playwright example

await page.locator('input[data-testid="email"]').fill('[email protected]');



// Or with XPath

await page.locator('//button[text()="Sign in"]').click();







Conclusion



Understanding how Xpath and CSS selectors work is fundamental knowledge for a professional AQA engineer.



The ability to build stable and reliable selectors improves the quality of your automated tests, making them resistant to most changes in the UI of the product being tested.



Keep this in mind the next time you are looking for a selector to automate your test case.



Follow our social media profiles so you don’t miss new updates: LinkedIn | Dev.to | Medium | Walltech

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Vulnerability Remediation & Verification
Syntax validiert (0 Fehler)
title: Detect Exploitation - XPath & CSS Selectors
id: 11120e16-6294-4dc9-9f99-499cdc74de07
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-27
logsource:
  category: network_connection
  product: any
detection:
  selection:
      DestinationHostname:
        - 'dev.to'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-27"
        description = "YARA Signature for "
    strings:
        $str = "XPath & CSS Selectors" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
(dest_host="dev.to")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
destination.domain: ("dev.to") and event.category: "network"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where DestinationHostName in ("dev.to")
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

IoC Intelligence (1 Indikatoren)
dev[.]to
CTI Threat Relationship Graph2 Knoten / 1 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Analyse für identifizierte Bedrohung auf Basis von Live-CTI (ENISA EUVD): CVSS 0.0 · EPSS 0.0% · CISA KEV: nein. Handlungsableitung aus den verlinkten Hersteller-Quellen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten XPath & CSS Selectors

Thematisch verwandte Begriffe: XPath, Selectors · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

💬 Kommentare werden geladen…
Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-100739 | A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag