QAble

Browse by type

Explore all services
Functional
Functional Testing
End-to-end feature validation
Software Testing
Full-stack QA across disciplines
Software QA
Process, standards & audit QA
Independent Testing
Vendor-neutral V&V & sign-off
Cyber Security Testing
Pen testing & exploit validation
Enterprise Testing
ERP, CRM & core platform QA
Manual Testing
Human-driven QA testing
Exploratory Testing
Discover hidden edge cases
User Acceptance Testing
Business-aligned validation
Usability Testing
Real user experience testing
UI/UX Testing
Interface & interaction QA
Accessibility Testing
WCAG compliance testing
Accessibility Audit
Compliance gap assessment
Accessibility Remediation
Fix accessibility violations
Digital Accessibility
End-to-end inclusive design QA
Security & VAPT
Vulnerability assessment
VAPT Testing
Penetration testing & compliance
Performance Testing
Load & stress testing
Non-Functional Testing
Performance, security & reliability
Compatibility Testing
Cross-device & browser QA
Scalability Testing
Capacity & growth QA
Agile Testing
Sprint-aligned QA
Localization Testing
Language & regional QA
Digital Testing
Digital experience QA

What's New

Solution

Tesbo-X, Playwright Automation Framework

Intelligent test selection, parallel CI execution, and rich trace reporting unified in a single automation system.

Try for Free →
View all services
About UsWhy QAbleCertificationsCareers
Knowledge HubBlogQAble WeeklyCase StudiesEbooksUtilities
BetterBugs
BetterBugs
Tesbo-X
Tesbo-X
Talk to QA Advisor
Browse the Knowledge Hub74 resources
/Test Cases/Report and export test cases

Test cases

Export test cases, because a file leaves your permission model behind

Twenty five cases covering what the export actually includes, permission and field level filtering, spreadsheet formula injection, encoding and delimiters, typed numbers and dates, row limits and background jobs, link expiry, snapshot consistency, PDF structure and audit logging.

25cases/7coverage types/5security cases/FreeCSV download

All 25 test cases, ready to copy

Free to use and adapt, no sign-up. Download as CSV or Markdown, or copy it straight into your own tooling.

Last updated

25 worked examples

EXP-01

Export with no filters applied

TypeFunctionalPriorityHigh
Test data
A data set of known size
Expected result
The file contains exactly the expected rows plus one header row, and the row count matches the total shown in the interface.
EXP-02

Confirm whether the export covers the page or the whole set

TypeFunctionalPriorityHigh
Test data
Trigger the export from page three of a paginated list
Expected result
The behaviour matches what the control says. An export labelled "export" that silently returns twenty five rows is the most common complaint about this feature.
EXP-03

Export with filters, search and sort applied

TypeFunctionalPriorityHigh
Test data
A filter, a search term and a non default sort together
Expected result
All three are honoured in the file, and the order matches what was on screen.
EXP-04

Verify the export honours permissions

TypeSecurityPriorityHigh
Test data
Export as a restricted user whose list contains records owned by others
Expected result
Only permitted records and permitted columns appear. Exports frequently build their own query and bypass the filters applied to the screen.
EXP-05

Verify field level restrictions in the file

TypeSecurityPriorityHigh
Test data
A role that must not see salary, contact details or internal notes
Expected result
Those columns are absent rather than blank, since a blank column still discloses that the field exists and how many records hold a value.
EXP-06

Attempt formula injection through exported content

TypeSecurityPriorityHigh
Test data
A record whose text field begins with =, +, -, @ or a tab, for example =HYPERLINK("http://x","click")
Expected result
The value is neutralised, typically by prefixing it so the spreadsheet treats it as text. Opening a CSV that executes a formula is a real attack on your own staff and is almost never tested.
EXP-07

Verify special characters inside cells

TypeBoundaryPriorityHigh
Test data
Values containing commas, semicolons, double quotes, line breaks and tabs
Expected result
Correctly quoted and escaped so the column count stays constant. A single unescaped line break shifts every subsequent row.
EXP-08

Verify encoding of non Latin characters

TypeCompatibilityPriorityHigh
Test data
Names in Devanagari, Arabic and Chinese, plus accented Latin characters and emoji
Expected result
Readable when opened in Excel, Numbers and Sheets. UTF-8 with a byte order mark is usually required for Excel to interpret it correctly.
EXP-09

Verify the delimiter for the user locale

TypeCompatibilityPriorityMedium
Test data
Open the file in a locale that expects a semicolon separator
Expected result
Either the delimiter suits the locale or the interface offers a choice, so a European user does not get every row in one column.
EXP-10

Verify numbers are typed rather than text

TypeBoundaryPriorityHigh
Test data
Currency amounts, percentages, large numbers, and identifiers with leading zeros
Expected result
Numeric columns sum correctly in a spreadsheet, and identifiers that must keep leading zeros are exported as text rather than losing them.
EXP-11

Verify date and time formatting

TypeBoundaryPriorityHigh
Test data
A timestamp, a date only value, and a record created in another timezone
Expected result
A stated, unambiguous format, ideally ISO, with the timezone declared. Dates that arrive as text in one locale and as a serial number in another break every downstream report.
EXP-12

Export an empty result set

TypeBoundaryPriorityMedium
Test data
A filter that matches nothing
Expected result
A file with headers and no rows, or a clear message that there is nothing to export. Never a zero byte file with no explanation.
EXP-13

Export at and beyond the row limit

TypeBoundaryPriorityHigh
Test data
A set at the documented maximum, then one well beyond it
Expected result
At the limit the file is complete. Beyond it the user is told the export was truncated, or it is queued as a background job. Silent truncation produces reporting decisions made on partial data.
EXP-14

Verify a large export runs as a background job

TypePerformancePriorityHigh
Test data
An export of several hundred thousand rows
Expected result
Queued with progress feedback, the user is notified on completion, and the request does not hold a connection open until a gateway timeout kills it.
EXP-15

Verify the download link is authorised and expires

TypeSecurityPriorityHigh
Test data
Open the link while signed out, from another account, and after its stated expiry
Expected result
Refused in all three cases. A generated export often contains the most sensitive data in the product and must not sit behind a guessable permanent URL.
EXP-16

Verify data consistency while the export runs

TypeStatePriorityHigh
Test data
Modify and delete records while a long export is generating
Expected result
The file reflects a consistent snapshot, and the report states the moment it was taken so two people comparing files can explain a difference.
EXP-17

Cancel an export in progress

TypeStatePriorityMedium
Test data
Cancel a queued job partway through
Expected result
The job stops, no partial file is offered as complete, and temporary storage is cleaned up.
EXP-18

Trigger several exports at once

TypePerformancePriorityMedium
Test data
The same user requesting five large exports in a minute
Expected result
Queued or rate limited rather than each consuming a worker. Unlimited concurrent exports are a straightforward way to exhaust a reporting database.
EXP-19

Verify PDF output structure

TypeFunctionalPriorityMedium
Test data
A report spanning several pages, with a wide table
Expected result
Headers repeat, rows are not split mid record, page numbers are present, wide tables are handled rather than clipped, and the footer states filters and generation time.
EXP-20

Verify PDF fonts and non Latin text

TypeCompatibilityPriorityMedium
Test data
Non Latin names and currency symbols in a generated PDF
Expected result
Rendered with an embedded font rather than as boxes or blank space, which is the usual symptom of a missing glyph.
EXP-21

Verify the file name and its collisions

TypeFunctionalPriorityMedium
Test data
Two exports of the same report in the same minute
Expected result
Names include the report and a timestamp so files are distinguishable, and no unsafe characters appear in the name.
EXP-22

Verify totals in the report match the interface

TypeFunctionalPriorityHigh
Test data
A report with sums, averages and counts
Expected result
Figures agree with the screen to the last decimal, including rounding, and any difference in method is documented.
EXP-23

Verify a scheduled or emailed export

TypeFunctionalPriorityHigh
Test data
A daily scheduled report, plus a recipient whose access has since been revoked
Expected result
Delivered on schedule, permissions re-evaluated at generation time, and a revoked recipient stops receiving data rather than continuing indefinitely.
EXP-24

Verify the export is recorded for audit

TypeSecurityPriorityHigh
Test data
Export a report containing personal data
Expected result
Who exported what, when and with which filters is recorded. Bulk extraction is exactly the event an audit needs to reconstruct.
EXP-25

Verify the export control is accessible

TypeAccessibilityPriorityMedium
Test data
Keyboard only, then NVDA or VoiceOver
Expected result
The control is reachable and labelled, format choices are announced, and progress plus completion or failure are announced rather than only shown.

What goes in each field

ID

Required

Stable identifier, prefixed by module.

Test case

Required

What is being verified, in one line.

Type

Functional, negative, boundary, security, state, performance, accessibility or compatibility. Use it to check coverage is spread rather than clustered on the happy path.

Priority

Risk based. An export that includes records the user cannot see, or a cell that executes when opened, is High. Formatting problems are Medium unless the figures are used for financial reporting.

Test data

The specific values, including the invalid and boundary ones.

Expected result

Required

The precise observable outcome, including message text where the wording itself is the requirement.

How To Use This

Export as the least privileged user

An export builds its own query, so it is the most common place a carefully built permission model is bypassed.

Compare file against screen

Export as a restricted user and count rows and columns. Extra records or extra fields mean the export query ignores your filters.

Put a formula in your data

Set a text field to =HYPERLINK(...) and open the file. If the spreadsheet evaluates it, your own staff are the target.

Open it in Excel, not a text editor

Encoding, delimiters, leading zeros and date serials only misbehave in a real spreadsheet.

Export beyond the limit

Silent truncation is the worst outcome here, because decisions get made on partial data that looks complete.

What Most Sets Miss

Why exports are a security feature

Permission bypass through export is common because the export path is usually written separately from the list it exports. The screen applies scoping through one query builder, and the export assembles its own for performance, missing a clause. The result is a file containing records the user could never see in the interface, which then leaves your system entirely. Always test the export as your most restricted role, and check columns as well as rows.

Formula injection is the case almost nobody writes. If a text field begins with an equals sign, a plus, a minus or an at sign, a spreadsheet may treat the cell as a formula when the file is opened, which can be used to build a link that exfiltrates neighbouring cells or to prompt the reader into running something. The victims are your own staff opening a routine report. Neutralise those values on export.

Fidelity problems are less dramatic and more frequent: identifiers losing leading zeros, dates arriving as serial numbers, amounts imported as text so nothing sums, and non Latin names rendering as question marks without a byte order mark. Open every export in Excel, Numbers and Sheets, because they disagree with each other.

Finally, treat a generated file as a live asset. It usually contains the most sensitive data in the product, so its download link needs authorisation and an expiry, the job needs a consistent snapshot with a stated generation time, and the act of exporting needs to be recorded. Bulk extraction is precisely the event an audit will ask you to reconstruct.

Suggest an improvement

Reports feeding decisions or audits?

QAble tests reporting and export paths including permission filtering, numeric fidelity and the injection cases spreadsheets introduce.

Security testing services

More test case sets

View all

Test cases for a login page

Test cases25 cases across functional, negative, boundary, security, session and accessibility paths, including account enumeration and lockout.

Test cases for a registration form

Test cases28 cases covering validation, duplicate accounts, email verification, password rules and the enumeration leak most signup forms ship with.

Test cases for search functionality

Test cases28 cases across relevance, partial and fuzzy matching, filters, pagination, empty states, injection attempts and performance under load.

Test cases for a shopping cart

Test cases27 cases on quantity limits, price recalculation, stock changes, coupon stacking, guest to account merge and cart persistence.

Test cases for checkout and payment

Test cases30 cases including 3D Secure, declines, timeouts, duplicate charges, idempotency, refunds and partial captures.

Test cases for file upload

Test cases28 cases on size and type limits, spoofed content types, malicious filenames, progress, resume, virus scanning and storage limits.

Test cases for forgot password

Test cases26 cases on reset token expiry, single use enforcement, session invalidation and the enumeration and rate limit gaps that are routine here.

Test cases for OTP verification

Test cases26 cases on expiry, resend throttling, attempt limits, code reuse, delivery failure and the brute force window teams forget to close.

Test cases for user roles and permissions

Test cases26 cases on horizontal and vertical privilege checks, direct object access, role changes mid-session and permission inheritance.

Test cases for form validation

Test cases27 rules-based cases on required fields, length and numeric boundaries, client and server parity, hidden field tampering and error accessibility.

Test cases for a date picker

Test cases26 cases on timezone shifts, ambiguous day and month order, impossible dates, min and max limits, leap years and keyboard operation.

Test cases for pagination

Test cases24 cases on ordering stability, records changing mid-session, page size caps, deep offset cost, permission-filtered totals and state restore.

Test cases for push notifications

Test cases26 cases on app states, deep link routing, token release on sign out, lock screen privacy, preferences, provider failures and platform differences.

Test cases for a chatbot

Test cases28 cases on paraphrased intents, context, fallback loops, human handoff, policy grounding, prompt injection and data scoping.

Test cases for net banking transactions

Test cases28 cases on duplicate debits from a retried request, concurrent transfers against one balance, daily limits across channels, beneficiary cooling periods, second factor binding and reconciliation.

Test cases for wallet and UPI payments

Test cases28 cases on payments that time out with no response, idempotency on retry, racing balances, caps across devices, collect request fraud, mandates and refunds.

Test cases for insurance claim submission

Test cases28 cases on coverage at the date of loss, waiting periods, deductibles and sub limits, exclusions and riders, duplicate claims and settlement reconciliation.

Test cases for patient records in an EHR

Test cases28 cases on duplicate detection and merge, wrong patient entry, units of measure, allergy and interaction alerting, break glass access and audit of reads.

Test cases for CRM lead management

Test cases28 cases on duplicate leads under concurrency, routing and the unrouted fallback, round robin races, territory visibility, conversion and bulk import.

Test cases for an ERP purchase order

Test cases28 cases on approval thresholds, amendments that must reset approval, budget commitment races, over receipt tolerance, three-way match and duplicate invoices.

Test cases for OTT video playback

Test cases28 cases on bitrate recovery after a dip, DRM renewal mid stream, concurrent stream limits and leaked slots, resume conflicts, ad cue points and offline expiry.

Test cases for game level progression

Test cases28 cases on save corruption during a crash write, cloud save conflicts, offline queue replay, unlock gating, currency exploits and purchase restore.

Test cases for a REST API

Test cases28 cases on status code correctness, cross tenant resource access, mass assignment, idempotent retries, cursor pagination, rate limits and contract drift.

Test cases for SSO and social login

Test cases28 cases on linking an account on an unverified email, state and code replay, redirect allow lists, token signature and issuer, deprovisioning and session rotation.

Test cases for subscription and billing

Test cases28 cases on mid cycle proration, duplicate and out of order webhooks, renewal double charges, dunning and grace, trials, coupons, metered usage and tax.

Test cases for data tables, filters and sorting

Test cases28 cases on unstable sorts across pages, filters that must reset pagination, selection surviving a filter change, bulk action scope and export fidelity.

Test cases for session timeout and concurrent login

Test cases28 cases on tokens that survive sign out, refresh token reuse, idle against absolute lifetime, multi tab expiry, session limits and remote revocation.

Test cases for a multi step form wizard

Test cases28 cases on values lost to back navigation, refresh and session expiry, step skipping, server side revalidation, duplicate submission and conditional branches.

Test cases for email verification

Test cases28 cases on token reuse and expiry, invalidating earlier links, account enumeration, header injection, safe address change and mail scanner prefetching.

Test cases for dashboards and analytics widgets

Test cases28 cases on reconciling against source rows, widgets that disagree, timezone aggregation, zero baselines, no data shown as zero and permission leaks in aggregates.

Test cases for booking and reservation

Test cases28 cases on concurrent bookings for the last slot, inventory holds that leak, payment without a booking, cancellation boundaries and channel sync.

Test cases for mobile app install and update

Test cases28 cases on migration chains across skipped versions, crashes during post upgrade migration, forced update lockouts, deep links and clean reinstall.

Test cases for accessibility (WCAG 2.2 AA)

Test cases28 cases on keyboard only completion, focus management, live region announcements, contrast, reflow at 320 pixels, target size and screen reader verification.

Test cases for performance and load

Test cases28 cases on spikes with no ramp, recovery after peak, soak and leak detection, pool exhaustion, cold caches, retry storms and data correctness under load.

Test cases for the OWASP Top 10

Test cases28 cases on broken access control, mass assignment, injection across every input surface, credential stuffing, session invalidation, SSRF and exposed secrets.

Test cases for cross browser compatibility

Test cases28 cases on storage that throws in private mode, blocked third party cookies, engine date parsing, mobile viewport units, in app browsers and ad blockers.

Test cases for database and data integrity

Test cases28 cases on uniqueness under concurrency, lost updates, counter races, orphaned rows, migration and backfill safety, replica lag and verified restores.

Test cases for localisation and multi language support

Test cases28 cases on text expansion, concatenated sentences, plural rules, locale date parsing, decimal separators, right to left layout, collation and encoding.

Test cases for outbound webhooks

Test cases28 cases on retry backoff and dead letter stores, one dead consumer degrading the pipeline, payload signing and replay windows, out of order delivery and endpoint SSRF.

Test cases for background jobs and queues

Test cases28 cases on work outliving the visibility timeout, idempotent handlers, poison messages, priority starvation, scheduler overlap across instances and graceful drain.

Test cases for real time features and websockets

Test cases28 cases on messages lost in the reconnect gap, half open connections, per channel authorisation, tokens expiring mid connection, backpressure and fanout across instances.

Test cases for file storage and media processing

Test cases28 cases on signed URL scope and expiry, serving before scanning completes, content type sniffing, metadata stripping, orphaned objects and derivative failures.

Test cases for CSV import and bulk operations

Test cases28 cases on reruns duplicating successes, delimiters inside quoted fields, byte order marks, leading zeros, ambiguous dates and bulk action scope.

Test cases for feature flags and progressive rollout

Test cases28 cases on unreachable flag services, unstable bucketing, rollouts that reshuffle users, kill switch latency, server and client mismatch and stale flags.

Test cases for Android app lifecycle and permissions

Test cases28 cases on state lost to process death, configuration changes, permanent permission denial, revocation while backgrounded, doze and battery restrictions.

Test cases for iOS app lifecycle and permissions

Test cases28 cases on the keychain surviving uninstall, suspended termination, limited photo access, allow once location, app switcher snapshots and biometric invalidation.

Test cases for wearable app sync

Test cases28 cases on data recorded away from the phone, duplicate records on resync, full buffers, clock drift, health permissions, battery budgets and unworn readings.

Test cases for VR and AR experiences

Test cases28 cases on the frame rate comfort floor, tracking loss, guardian boundaries, involuntary camera movement, AR anchor drift and spatial data privacy.

Test cases for IoT device pairing and telemetry

Test cases28 cases on offline buffering and reconnect floods, fleet wide reconnection storms, shared credentials, wrong device clocks and stale queued commands.

Test cases for embedded firmware update

Test cases28 cases on power loss mid write, automatic rollback and health confirmation, signature and anti rollback checks, staged rollouts and recovery mode.

Test cases for user profile and account settings

Test cases28 cases on partial saves reported as success, optimistic updates the server rejected, mass assignment through a profile form, avatar content inspection and session invalidation.

Test cases for account deletion and data export

Test cases28 cases on export links that must be authorised and expiring, deletion cascading to storage, caches, logs and processors, grace periods, legal holds and deadlines.

Test cases for consent and cookie management

Test cases28 cases on cookies and tracking requests firing before consent, reject parity with accept, tag manager bypass, withdrawal, cached banners and server side forwarding.

Test cases for notification preferences and delivery

Test cases28 cases on opt outs honoured on one channel and ignored on another, marketing sent as transactional, unsubscribe scope, imports resetting consent and digest timezones.

Test cases for admin impersonation and support access

Test cases28 cases on actions attributed to the customer instead of the admin, credential exposure, chained and upward impersonation, session expiry and immutable access records.

Test cases for audit logs and activity history

Test cases28 cases on forged entries through log injection, immutability and tamper detection, actor attribution across impersonation and jobs, retention and legal holds.

Sources

  • OWASP CSV Injection why exported cells beginning with a formula character are a defect.
  • OWASP ASVS verification requirements for authentication, session and access control.
  • WCAG 2.2 the success criteria behind the accessibility cases.

Want exports that cannot leak or mislead?

QAble tests reporting, exports and the data behind them with ISTQB-certified engineers. Start with a free QA audit.

Talk to QA Advisor