Browse the Knowledge Hub32 resources
Test cases
Export test cases, because a file leaves your permission model behind
Twenty five cases covering what the export actually includes, permission and field level filtering, spreadsheet formula injection, encoding and delimiters, typed numbers and dates, row limits and background jobs, link expiry, snapshot consistency, PDF structure and audit logging.
All 25 test cases, ready to copy
Free to use and adapt, no sign-up. Download as CSV or Markdown, or copy it straight into your own tooling.
Last updated
25 worked examples
Export with no filters applied
TypeFunctionalPriorityHigh- Test data
- A data set of known size
- Expected result
- The file contains exactly the expected rows plus one header row, and the row count matches the total shown in the interface.
Confirm whether the export covers the page or the whole set
TypeFunctionalPriorityHigh- Test data
- Trigger the export from page three of a paginated list
- Expected result
- The behaviour matches what the control says. An export labelled "export" that silently returns twenty five rows is the most common complaint about this feature.
Export with filters, search and sort applied
TypeFunctionalPriorityHigh- Test data
- A filter, a search term and a non default sort together
- Expected result
- All three are honoured in the file, and the order matches what was on screen.
Verify the export honours permissions
TypeSecurityPriorityHigh- Test data
- Export as a restricted user whose list contains records owned by others
- Expected result
- Only permitted records and permitted columns appear. Exports frequently build their own query and bypass the filters applied to the screen.
Verify field level restrictions in the file
TypeSecurityPriorityHigh- Test data
- A role that must not see salary, contact details or internal notes
- Expected result
- Those columns are absent rather than blank, since a blank column still discloses that the field exists and how many records hold a value.
Attempt formula injection through exported content
TypeSecurityPriorityHigh- Test data
- A record whose text field begins with =, +, -, @ or a tab, for example =HYPERLINK("http://x","click")
- Expected result
- The value is neutralised, typically by prefixing it so the spreadsheet treats it as text. Opening a CSV that executes a formula is a real attack on your own staff and is almost never tested.
Verify special characters inside cells
TypeBoundaryPriorityHigh- Test data
- Values containing commas, semicolons, double quotes, line breaks and tabs
- Expected result
- Correctly quoted and escaped so the column count stays constant. A single unescaped line break shifts every subsequent row.
Verify encoding of non Latin characters
TypeCompatibilityPriorityHigh- Test data
- Names in Devanagari, Arabic and Chinese, plus accented Latin characters and emoji
- Expected result
- Readable when opened in Excel, Numbers and Sheets. UTF-8 with a byte order mark is usually required for Excel to interpret it correctly.
Verify the delimiter for the user locale
TypeCompatibilityPriorityMedium- Test data
- Open the file in a locale that expects a semicolon separator
- Expected result
- Either the delimiter suits the locale or the interface offers a choice, so a European user does not get every row in one column.
Verify numbers are typed rather than text
TypeBoundaryPriorityHigh- Test data
- Currency amounts, percentages, large numbers, and identifiers with leading zeros
- Expected result
- Numeric columns sum correctly in a spreadsheet, and identifiers that must keep leading zeros are exported as text rather than losing them.
Verify date and time formatting
TypeBoundaryPriorityHigh- Test data
- A timestamp, a date only value, and a record created in another timezone
- Expected result
- A stated, unambiguous format, ideally ISO, with the timezone declared. Dates that arrive as text in one locale and as a serial number in another break every downstream report.
Export an empty result set
TypeBoundaryPriorityMedium- Test data
- A filter that matches nothing
- Expected result
- A file with headers and no rows, or a clear message that there is nothing to export. Never a zero byte file with no explanation.
Export at and beyond the row limit
TypeBoundaryPriorityHigh- Test data
- A set at the documented maximum, then one well beyond it
- Expected result
- At the limit the file is complete. Beyond it the user is told the export was truncated, or it is queued as a background job. Silent truncation produces reporting decisions made on partial data.
Verify a large export runs as a background job
TypePerformancePriorityHigh- Test data
- An export of several hundred thousand rows
- Expected result
- Queued with progress feedback, the user is notified on completion, and the request does not hold a connection open until a gateway timeout kills it.
Verify the download link is authorised and expires
TypeSecurityPriorityHigh- Test data
- Open the link while signed out, from another account, and after its stated expiry
- Expected result
- Refused in all three cases. A generated export often contains the most sensitive data in the product and must not sit behind a guessable permanent URL.
Verify data consistency while the export runs
TypeStatePriorityHigh- Test data
- Modify and delete records while a long export is generating
- Expected result
- The file reflects a consistent snapshot, and the report states the moment it was taken so two people comparing files can explain a difference.
Cancel an export in progress
TypeStatePriorityMedium- Test data
- Cancel a queued job partway through
- Expected result
- The job stops, no partial file is offered as complete, and temporary storage is cleaned up.
Trigger several exports at once
TypePerformancePriorityMedium- Test data
- The same user requesting five large exports in a minute
- Expected result
- Queued or rate limited rather than each consuming a worker. Unlimited concurrent exports are a straightforward way to exhaust a reporting database.
Verify PDF output structure
TypeFunctionalPriorityMedium- Test data
- A report spanning several pages, with a wide table
- Expected result
- Headers repeat, rows are not split mid record, page numbers are present, wide tables are handled rather than clipped, and the footer states filters and generation time.
Verify PDF fonts and non Latin text
TypeCompatibilityPriorityMedium- Test data
- Non Latin names and currency symbols in a generated PDF
- Expected result
- Rendered with an embedded font rather than as boxes or blank space, which is the usual symptom of a missing glyph.
Verify the file name and its collisions
TypeFunctionalPriorityMedium- Test data
- Two exports of the same report in the same minute
- Expected result
- Names include the report and a timestamp so files are distinguishable, and no unsafe characters appear in the name.
Verify totals in the report match the interface
TypeFunctionalPriorityHigh- Test data
- A report with sums, averages and counts
- Expected result
- Figures agree with the screen to the last decimal, including rounding, and any difference in method is documented.
Verify a scheduled or emailed export
TypeFunctionalPriorityHigh- Test data
- A daily scheduled report, plus a recipient whose access has since been revoked
- Expected result
- Delivered on schedule, permissions re-evaluated at generation time, and a revoked recipient stops receiving data rather than continuing indefinitely.
Verify the export is recorded for audit
TypeSecurityPriorityHigh- Test data
- Export a report containing personal data
- Expected result
- Who exported what, when and with which filters is recorded. Bulk extraction is exactly the event an audit needs to reconstruct.
Verify the export control is accessible
TypeAccessibilityPriorityMedium- Test data
- Keyboard only, then NVDA or VoiceOver
- Expected result
- The control is reachable and labelled, format choices are announced, and progress plus completion or failure are announced rather than only shown.
What goes in each field
ID
RequiredStable identifier, prefixed by module.
Test case
RequiredWhat is being verified, in one line.
Type
Functional, negative, boundary, security, state, performance, accessibility or compatibility. Use it to check coverage is spread rather than clustered on the happy path.
Priority
Risk based. An export that includes records the user cannot see, or a cell that executes when opened, is High. Formatting problems are Medium unless the figures are used for financial reporting.
Test data
The specific values, including the invalid and boundary ones.
Expected result
RequiredThe precise observable outcome, including message text where the wording itself is the requirement.
Export as the least privileged user
An export builds its own query, so it is the most common place a carefully built permission model is bypassed.
Compare file against screen
Export as a restricted user and count rows and columns. Extra records or extra fields mean the export query ignores your filters.
Put a formula in your data
Set a text field to =HYPERLINK(...) and open the file. If the spreadsheet evaluates it, your own staff are the target.
Open it in Excel, not a text editor
Encoding, delimiters, leading zeros and date serials only misbehave in a real spreadsheet.
Export beyond the limit
Silent truncation is the worst outcome here, because decisions get made on partial data that looks complete.
Why exports are a security feature
Permission bypass through export is common because the export path is usually written separately from the list it exports. The screen applies scoping through one query builder, and the export assembles its own for performance, missing a clause. The result is a file containing records the user could never see in the interface, which then leaves your system entirely. Always test the export as your most restricted role, and check columns as well as rows.
Formula injection is the case almost nobody writes. If a text field begins with an equals sign, a plus, a minus or an at sign, a spreadsheet may treat the cell as a formula when the file is opened, which can be used to build a link that exfiltrates neighbouring cells or to prompt the reader into running something. The victims are your own staff opening a routine report. Neutralise those values on export.
Fidelity problems are less dramatic and more frequent: identifiers losing leading zeros, dates arriving as serial numbers, amounts imported as text so nothing sums, and non Latin names rendering as question marks without a byte order mark. Open every export in Excel, Numbers and Sheets, because they disagree with each other.
Finally, treat a generated file as a live asset. It usually contains the most sensitive data in the product, so its download link needs authorisation and an expiry, the job needs a consistent snapshot with a stated generation time, and the act of exporting needs to be recorded. Bulk extraction is precisely the event an audit will ask you to reconstruct.
Suggest an improvementReports feeding decisions or audits?
QAble tests reporting and export paths including permission filtering, numeric fidelity and the injection cases spreadsheets introduce.
Security testing servicesMore test case sets
View allTest cases for a login page
Test cases25 cases across functional, negative, boundary, security, session and accessibility paths, including account enumeration and lockout.Test cases for a registration form
Test cases28 cases covering validation, duplicate accounts, email verification, password rules and the enumeration leak most signup forms ship with.Test cases for search functionality
Test cases28 cases across relevance, partial and fuzzy matching, filters, pagination, empty states, injection attempts and performance under load.Test cases for a shopping cart
Test cases27 cases on quantity limits, price recalculation, stock changes, coupon stacking, guest to account merge and cart persistence.Test cases for checkout and payment
Test cases30 cases including 3D Secure, declines, timeouts, duplicate charges, idempotency, refunds and partial captures.Test cases for file upload
Test cases28 cases on size and type limits, spoofed content types, malicious filenames, progress, resume, virus scanning and storage limits.Test cases for forgot password
Test cases26 cases on reset token expiry, single use enforcement, session invalidation and the enumeration and rate limit gaps that are routine here.Test cases for OTP verification
Test cases26 cases on expiry, resend throttling, attempt limits, code reuse, delivery failure and the brute force window teams forget to close.Test cases for user roles and permissions
Test cases26 cases on horizontal and vertical privilege checks, direct object access, role changes mid-session and permission inheritance.Test cases for form validation
Test cases27 rules-based cases on required fields, length and numeric boundaries, client and server parity, hidden field tampering and error accessibility.Test cases for a date picker
Test cases26 cases on timezone shifts, ambiguous day and month order, impossible dates, min and max limits, leap years and keyboard operation.Test cases for pagination
Test cases24 cases on ordering stability, records changing mid-session, page size caps, deep offset cost, permission-filtered totals and state restore.Test cases for push notifications
Test cases26 cases on app states, deep link routing, token release on sign out, lock screen privacy, preferences, provider failures and platform differences.Test cases for a chatbot
Test cases28 cases on paraphrased intents, context, fallback loops, human handoff, policy grounding, prompt injection and data scoping.Sources
- OWASP CSV Injection why exported cells beginning with a formula character are a defect.
- OWASP ASVS verification requirements for authentication, session and access control.
- WCAG 2.2 the success criteria behind the accessibility cases.
Want exports that cannot leak or mislead?
QAble tests reporting, exports and the data behind them with ISTQB-certified engineers. Start with a free QA audit.