function SearchCommentTest::testSearchResultsComment

Verify that comments are rendered using proper format in search results.

File

core/modules/search/tests/src/Functional/SearchCommentTest.php, line 96

Class

SearchCommentTest

Tests integration searching comments.

Namespace

Code

public function testSearchResultsComment() {
    $node_storage = $this->container
        ->get('entity_type.manager')
        ->getStorage('node');
    // Create basic_html format that escapes all HTML.
    $basic_html_format = FilterFormat::create([
        'format' => 'basic_html',
        'name' => 'Basic HTML',
        'weight' => 1,
        'filters' => [
            'filter_html_escape' => [
                'status' => 1,
            ],
        ],
        'roles' => [
            RoleInterface::AUTHENTICATED_ID,
        ],
    ]);
    $basic_html_format->save();
    $comment_body = 'Test comment body';
    // Make preview optional.
    $field = FieldConfig::loadByName('node', 'article', 'comment');
    $field->setSetting('preview', DRUPAL_OPTIONAL);
    $field->save();
    // Allow anonymous users to search content.
    $edit = [
        RoleInterface::ANONYMOUS_ID . '[search content]' => 1,
        RoleInterface::ANONYMOUS_ID . '[access comments]' => 1,
        RoleInterface::ANONYMOUS_ID . '[post comments]' => 1,
    ];
    $this->drupalPostForm('admin/people/permissions', $edit, t('Save permissions'));
    // Create a node.
    $node = $this->drupalCreateNode([
        'type' => 'article',
    ]);
    // Post a comment using 'Full HTML' text format.
    $edit_comment = [];
    $edit_comment['subject[0][value]'] = 'Test comment subject';
    $edit_comment['comment_body[0][value]'] = '<h1>' . $comment_body . '</h1>';
    $full_html_format_id = 'full_html';
    $edit_comment['comment_body[0][format]'] = $full_html_format_id;
    $this->drupalPostForm('comment/reply/node/' . $node->id() . '/comment', $edit_comment, t('Save'));
    // Post a comment with an evil script tag in the comment subject and a
    // script tag nearby a keyword in the comment body. Use the 'FULL HTML' text
    // format so the script tag stored.
    $edit_comment2 = [];
    $edit_comment2['subject[0][value]'] = "<script>alert('subjectkeyword');</script>";
    $edit_comment2['comment_body[0][value]'] = "nearbykeyword<script>alert('somethinggeneric');</script>";
    $edit_comment2['comment_body[0][format]'] = $full_html_format_id;
    $this->drupalPostForm('comment/reply/node/' . $node->id() . '/comment', $edit_comment2, t('Save'));
    // Post a comment with a keyword inside an evil script tag in the comment
    // body. Use the 'FULL HTML' text format so the script tag is stored.
    $edit_comment3 = [];
    $edit_comment3['subject[0][value]'] = 'asubject';
    $edit_comment3['comment_body[0][value]'] = "<script>alert('insidekeyword');</script>";
    $edit_comment3['comment_body[0][format]'] = $full_html_format_id;
    $this->drupalPostForm('comment/reply/node/' . $node->id() . '/comment', $edit_comment3, t('Save'));
    // Invoke search index update.
    $this->drupalLogout();
    $this->cronRun();
    // Search for the comment subject.
    $edit = [
        'keys' => "'" . $edit_comment['subject[0][value]'] . "'",
    ];
    $this->drupalPostForm('search/node', $edit, t('Search'));
    $node_storage->resetCache([
        $node->id(),
    ]);
    $node2 = $node_storage->load($node->id());
    $this->assertText($node2->label(), 'Node found in search results.');
    $this->assertText($edit_comment['subject[0][value]'], 'Comment subject found in search results.');
    // Search for the comment body.
    $edit = [
        'keys' => "'" . $comment_body . "'",
    ];
    $this->drupalPostForm(NULL, $edit, t('Search'));
    $this->assertText($node2->label(), 'Node found in search results.');
    // Verify that comment is rendered using proper format.
    $this->assertText($comment_body, 'Comment body text found in search results.');
    $this->assertNoRaw(t('n/a'), 'HTML in comment body is not hidden.');
    $this->assertNoEscaped($edit_comment['comment_body[0][value]']);
    // Search for the evil script comment subject.
    $edit = [
        'keys' => 'subjectkeyword',
    ];
    $this->drupalPostForm('search/node', $edit, t('Search'));
    // Verify the evil comment subject is escaped in search results.
    $this->assertRaw('&lt;script&gt;alert(&#039;<strong>subjectkeyword</strong>&#039;);');
    $this->assertNoRaw('<script>');
    // Search for the keyword near the evil script tag in the comment body.
    $edit = [
        'keys' => 'nearbykeyword',
    ];
    $this->drupalPostForm('search/node', $edit, t('Search'));
    // Verify that nearby script tag in the evil comment body is stripped from
    // search results.
    $this->assertRaw('<strong>nearbykeyword</strong>');
    $this->assertNoRaw('<script>');
    // Search for contents inside the evil script tag in the comment body.
    $edit = [
        'keys' => 'insidekeyword',
    ];
    $this->drupalPostForm('search/node', $edit, t('Search'));
    // @todo Verify the actual search results.
    //   https://www.drupal.org/node/2551135
    // Verify there is no script tag in search results.
    $this->assertNoRaw('<script>');
    // Hide comments.
    $this->drupalLogin($this->adminUser);
    $node->set('comment', CommentItemInterface::HIDDEN);
    $node->save();
    // Invoke search index update.
    $this->drupalLogout();
    $this->cronRun();
    // Search for $title.
    $this->drupalPostForm('search/node', $edit, t('Search'));
    $this->assertText(t('Your search yielded no results.'));
}