Viewing is open to everyone. Downloading and starring need a GitHub sign-in.
Sign in with GitHub
FT-11.md
v0.1.0-build.85
Latest
Commit ede38f5
Sign in with GitHub to download. Each download is recorded with your GitHub username.
| 1 | # FT-11: Payload safety |
| 2 | |
| 3 | <!-- Generated from field-tests/suite.json by tools/field_tests.py. Edit the JSON, not this file. --> |
| 4 | |
| 5 | **Category:** Safety · **Time:** about 10 minutes · **Run it and see results:** [https://openckey.org/tests/test?id=FT-11](https://openckey.org/tests/test?id=FT-11) |
| 6 | |
| 7 | ## What it checks |
| 8 | |
| 9 | A reader shows what a code holds and acts only on a tap, and flags content that is not a plain link. |
| 10 | |
| 11 | ## Why |
| 12 | |
| 13 | A code can hold anything, including a disguised link or a script-like string. The payload conventions say a reader must show the content and never act on its own; this checks that a reader does. |
| 14 | |
| 15 | ## Test codes |
| 16 | |
| 17 | Print or open the sheet at [https://openckey.org/tests/sheet?id=FT-11](https://openckey.org/tests/sheet?id=FT-11). It is drawn by the CKey web SDK from the values below. |
| 18 | |
| 19 | | Code | Size | Version | Level | Layout | Style | Holds | |
| 20 | |---|---|---|---|---|---|---| |
| 21 | | A | 1.5 in | smallest that fits | M | standard | plain | `https://openckey.org/t/FT11-A` | |
| 22 | | B | 1.5 in | smallest that fits | M | standard | plain | `tel:+15550100` | |
| 23 | | C | 1.5 in | smallest that fits | M | standard | plain | `javascript:alert('field test FT-11')` | |
| 24 | | D | 1.5 in | smallest that fits | M | standard | plain | `Field test FT-11, code D. This is plain text: a reader should show it and offer to copy it, not open anything.` | |
| 25 | |
| 26 | ## Set up |
| 27 | |
| 28 | 1. Print the test sheet at 100% scale, or show it on a second screen. |
| 29 | |
| 30 | ## Steps |
| 31 | |
| 32 | 1. Scan each code, A to D. |
| 33 | 2. For each, record whether the reader showed the content before doing anything, and whether anything happened (a page opened, a call started) without your tap. |
| 34 | 3. Do not tap through on code C. |
| 35 | |
| 36 | ## What to record |
| 37 | |
| 38 | - **Content shown before any action**, boolean, required. For each of: A link, B phone, C script, D text. |
| 39 | - **Something happened without a tap**, boolean, required. For each of: A link, B phone, C script, D text. |
| 40 | |
| 41 | Every report also records the device, operating system, reader and its version, and the printer or screen. |
| 42 | |
| 43 | ## How to grade it |
| 44 | |
| 45 | - **Pass:** Every code's content was shown first and nothing happened without a tap; code C offered no way to run it. |
| 46 | - **Partial:** Every code's content was shown first and nothing happened without a tap, but code C could be run. |
| 47 | - **Fail:** Anything happened without a tap. |
| 48 | |
| 49 | ## Report a result |
| 50 | |
| 51 | - On openckey.org: [https://openckey.org/tests/test?id=FT-11](https://openckey.org/tests/test?id=FT-11), with optional photos. |
| 52 | - On GitHub: [open a field-test report](https://github.com/clearkeysolutions/ckey/issues/new?template=field-test-report.yml&title=%5BFT-11%5D+) and choose FT-11. |
| 53 | |
| 54 | Both are published together at [https://openckey.org/tests](https://openckey.org/tests) and as JSON at [https://openckey.org/api/field/results](https://openckey.org/api/field/results). |