function ContentPreviewToggleTest::testBlockLabelXss

Tests that block labels are properly escaped in preview.

File

core/modules/layout_builder/tests/src/FunctionalJavascript/ContentPreviewToggleTest.php, line 134

Class

ContentPreviewToggleTest

Tests toggling of content preview.

Namespace

Code

public function testBlockLabelXss() : void {
  $page = $this->getSession()
    ->getPage();
  $node = $this->createNode([
    'type' => 'bundle_for_this_particular_test',
  ]);
  $section = new Section('layout_onecol');
  $component = new SectionComponent(\Drupal::service('uuid')->generate(), 'content', [
    'id' => 'user_login_block',
    'label' => '<img src="x" onerror="document.querySelector(\'body\').innerHTML = \'XSS has been triggered\';">',
  ]);
  $section->appendComponent($component);
  $node->get(OverridesSectionStorage::FIELD_NAME)
    ->appendSection($section);
  $node->save();
  $this->drupalGet('node/1/layout');
  $page->uncheckField('layout-builder-content-preview');
  $this->assertNotEmpty($this->assertSession()
    ->waitForElementVisible('css', '.layout-builder-block__content-preview-placeholder-label'));
  // Add a micro-sleep here to give the browser a moment to try
  // trigger the XSS.
  usleep(100000);
  // If this is still present after the preview has been enabled, then
  // the XSS has not been triggered.
  $this->assertSession()
    ->elementExists('css', '.layout-builder-block__content-preview-placeholder-label');
}