EntityReferenceXSSTest.php

<?php

namespace Drupal\Tests\field\Functional\EntityReference;

use Drupal\Core\Entity\Entity\EntityFormDisplay;
use Drupal\Core\Entity\Entity\EntityViewDisplay;
use Drupal\Tests\BrowserTestBase;
use Drupal\Tests\field\Traits\EntityReferenceTestTrait;

/**
 * Tests possible XSS security issues in entity references.
 *
 * @group entity_reference
 */
class EntityReferenceXSSTest extends BrowserTestBase {
  use EntityReferenceTestTrait;
  
  /**
   * Modules to enable.
   *
   * @var array
   */
  protected static $modules = [
    'node',
  ];
  
  /**
   * {@inheritdoc}
   */
  protected $defaultTheme = 'stark';
  
  /**
   * Tests markup is escaped in the entity reference select and label formatter.
   */
  public function testEntityReferenceXSS() {
    $this->drupalCreateContentType([
      'type' => 'article',
    ]);
    // Create a node with markup in the title.
    $node_type_one = $this->drupalCreateContentType();
    $node = [
      'type' => $node_type_one->id(),
      'title' => '<em>I am kitten</em>',
    ];
    $referenced_node = $this->drupalCreateNode($node);
    $node_type_two = $this->drupalCreateContentType([
      'name' => '<em>bundle with markup</em>',
    ]);
    $this->drupalCreateNode([
      'type' => $node_type_two->id(),
      'title' => 'My bundle has markup',
    ]);
    $this->createEntityReferenceField('node', 'article', 'entity_reference_test', 'Entity Reference test', 'node', 'default', [
      'target_bundles' => [
        $node_type_one->id(),
        $node_type_two->id(),
      ],
    ]);
    EntityFormDisplay::load('node.article.default')->setComponent('entity_reference_test', [
      'type' => 'options_select',
    ])
      ->save();
    EntityViewDisplay::load('node.article.default')->setComponent('entity_reference_test', [
      'type' => 'entity_reference_label',
    ])
      ->save();
    // Create a node and reference the node with markup in the title.
    $this->drupalLogin($this->rootUser);
    $this->drupalGet('node/add/article');
    $this->assertSession()
      ->assertEscaped($referenced_node->getTitle());
    $this->assertSession()
      ->assertEscaped($node_type_two->label());
    $edit = [
      'title[0][value]' => $this->randomString(),
      'entity_reference_test' => $referenced_node->id(),
    ];
    $this->submitForm($edit, 'Save');
    $this->assertSession()
      ->assertEscaped($referenced_node->getTitle());
    // Test the options_buttons type.
    EntityFormDisplay::load('node.article.default')->setComponent('entity_reference_test', [
      'type' => 'options_buttons',
    ])
      ->save();
    $this->drupalGet('node/add/article');
    $this->assertSession()
      ->assertEscaped($referenced_node->getTitle());
    // options_buttons does not support optgroups.
    $this->assertSession()
      ->pageTextNotContains('bundle with markup');
  }

}