function UrlTest::testLinkXSS

Confirms that invalid URLs are filtered in link generating functions.

File

core/modules/system/tests/src/Kernel/Common/UrlTest.php, line 33

Class

UrlTest

Tests the Url object.

Namespace

Code

public function testLinkXSS() : void {
    // Test link generator.
    $text = $this->randomMachineName();
    $path = "<SCRIPT>alert('XSS')</SCRIPT>";
    $encoded_path = "%3CSCRIPT%3Ealert%28%27XSS%27%29%3C/SCRIPT%3E";
    $link = (string) Link::fromTextAndUrl($text, Url::fromUserInput('/' . $path))->toString();
    $this->assertStringContainsString($encoded_path, $link, "XSS attack {$path} was filtered by \\Drupal\\Core\\Utility\\LinkGeneratorInterface::generate().");
    $this->assertStringNotContainsString($path, $link, "XSS attack {$path} was filtered by \\Drupal\\Core\\Utility\\LinkGeneratorInterface::generate().");
    // Test \Drupal\Core\Url.
    $link = (string) Url::fromUri('base:' . $path)->toString();
    $this->assertStringContainsString($encoded_path, $link, "XSS attack {$path} was filtered by #theme");
    $this->assertStringNotContainsString($path, $link, "XSS attack {$path} was filtered by #theme");
}