class DateFormatTest

class DateFormatTest extends WebDriverTestBase {

  /**
   * {@inheritdoc}
   */
  protected static $modules = [
    'block',
  ];

  /**
   * {@inheritdoc}
   */
  protected $defaultTheme = 'stark';

  /**
   * {@inheritdoc}
   */
  protected function setUp() : void {
    parent::setUp();

    // Create admin user and log in admin user.
    $this
      ->drupalLogin($this
      ->drupalCreateUser([
      'administer site configuration',
    ]));
    $this
      ->drupalPlaceBlock('local_actions_block');
  }

  /**
   * Tests XSS via date format configuration.
   */
  public function testDateFormatXss() {
    $page = $this
      ->getSession()
      ->getPage();
    $assert = $this
      ->assertSession();
    $date_format = DateFormat::create([
      'id' => 'xss_short',
      'label' => 'XSS format',
      'pattern' => '\\<\\s\\c\\r\\i\\p\\t\\>\\a\\l\\e\\r\\t\\(\\"\\X\\S\\S\\")\\;\\<\\/\\s\\c\\r\\i\\p\\t\\>',
    ]);
    $date_format
      ->save();
    $this
      ->drupalGet('admin/config/regional/date-time');
    $assert
      ->assertEscaped('<script>alert("XSS");</script>');
    $this
      ->drupalGet('admin/config/regional/date-time/formats/manage/xss_short');
    $assert
      ->assertEscaped('<script>alert("XSS");</script>');

    // Add a new date format with HTML in it.
    $this
      ->drupalGet('admin/config/regional/date-time/formats/add');
    $date_format = '& \\<\\e\\m\\>Y\\<\\/\\e\\m\\>';
    $page
      ->fillField('date_format_pattern', $date_format);
    $assert
      ->waitForText('Displayed as');
    $assert
      ->assertEscaped('<em>' . date("Y") . '</em>');
    $page
      ->fillField('label', 'date_html_pattern');

    // Wait for the machine name ID to be completed.
    $assert
      ->waitForLink('Edit');
    $page
      ->pressButton('Add format');
    $assert
      ->pageTextContains('Custom date format added.');
    $assert
      ->assertEscaped('<em>' . date("Y") . '</em>');
  }

}