function FieldCustomTest::testCustomFieldXss

Ensure that custom field content is XSS filtered.

File

core/modules/views/tests/src/Kernel/Handler/FieldCustomTest.php, line 97

Class

FieldCustomTest

Tests the core <a href="/api/drupal/core%21modules%21views%21src%21Plugin%21views%21field%21Custom.php/class/Custom/11.x" title="A handler to provide a field that is completely custom by the administrator." class="local">Drupal\views\Plugin\views\field\Custom</a> handler.

Namespace

Code

public function testCustomFieldXss() : void {
    $view = Views::getView('test_view');
    $view->setDisplay();
    // Alter the text of the field to include XSS.
    $text = '<script>alert("kittens")</script>';
    $view->displayHandlers
        ->get('default')
        ->overrideOption('fields', [
        'name' => [
            'id' => 'name',
            'table' => 'views_test_data',
            'field' => 'name',
            'relationship' => 'none',
            'alter' => [
                'text' => $text,
            ],
        ],
    ]);
    $this->executeView($view);
    $this->assertEquals(Xss::filter($text), $view->style_plugin
        ->getField(0, 'name'));
}