www.aleph1.co.uk Git - yaffs-website/blob - web/core/modules/views_ui/src/Tests/XssTest.php

   1 <?php
   2
   3 namespace Drupal\views_ui\Tests;
   4
   5 /**
   6  * Tests the Xss vulnerability.
   7  *
   8  * @group views_ui
   9  */
  10 class XssTest extends UITestBase {
  11
  12   /**
  13    * Modules to enable.
  14    *
  15    * @var array
  16    */
  17   public static $modules = ['node', 'user', 'views_ui', 'views_ui_test'];
  18
  19   public function testViewsUi() {
  20     $this->drupalGet('admin/structure/views/view/sa_contrib_2013_035');
  21     $this->assertEscaped('<marquee>test</marquee>', 'Field admin label is properly escaped.');
  22
  23     $this->drupalGet('admin/structure/views/nojs/handler/sa_contrib_2013_035/page_1/header/area');
  24     $this->assertEscaped('{{ title }} == <marquee>test</marquee>', 'Token label is properly escaped.');
  25     $this->assertEscaped('{{ title_1 }} == <script>alert("XSS")</script>', 'Token label is properly escaped.');
  26   }
  27
  28   /**
  29    * Checks the admin UI for double escaping.
  30    */
  31   public function testNoDoubleEscaping() {
  32     $this->drupalGet('admin/structure/views');
  33     $this->assertNoEscaped('&lt;');
  34
  35     $this->drupalGet('admin/structure/views/view/sa_contrib_2013_035');
  36     $this->assertNoEscaped('&lt;');
  37
  38     $this->drupalGet('admin/structure/views/nojs/handler/sa_contrib_2013_035/page_1/header/area');
  39     $this->assertNoEscaped('&lt;');
  40   }
  41
  42 }