ModuleThemePageXssVulnerabilityTest.php

<?php

declare (strict_types=1);
namespace Drupal\Tests\system\Functional;

use Drupal\Tests\BrowserTestBase;

/**
 * Tests module and theme pages do not have XSS vulnerabilities.
 *
 * @group system
 */
class ModuleThemePageXssVulnerabilityTest extends BrowserTestBase {
    
    /**
     * {@inheritdoc}
     */
    protected static $modules = [
        'system',
    ];
    
    /**
     * {@inheritdoc}
     */
    protected $defaultTheme = 'stark';
    
    /**
     * {@inheritdoc}
     */
    protected function setUp() : void {
        parent::setUp();
        $admin = $this->drupalCreateUser([
            'administer modules',
            'administer themes',
        ]);
        $this->drupalLogin($admin);
    }
    
    /**
     * Tests extension info cannot create XSS vulnerabilities.
     */
    public function testExtensionInfoXss() : void {
        $this->drupalGet("admin/modules");
        $this->assertSession()
            ->pageTextContains("alert('Evil module name');");
        $this->assertSession()
            ->pageTextContains("alert('Evil module desc');");
        $this->assertSession()
            ->responseNotContains("<script>alert(");
        $this->drupalGet("admin/appearance");
        $this->assertSession()
            ->pageTextContains("alert('Evil theme name');");
        $this->assertSession()
            ->pageTextContains("alert('Evil theme desc');");
        $this->assertSession()
            ->responseNotContains("<script>alert(");
    }

}