function DisplayPathTest::doPathXssFilterTest

Tests that View paths are properly filtered for XSS.

File

core/modules/views_ui/tests/src/Functional/DisplayPathTest.php, line 76

Class

DisplayPathTest

Tests the UI of generic display path plugin.

Namespace

Code

public function doPathXssFilterTest() {
    $this->drupalGet('admin/structure/views/view/test_view');
    $this->submitForm([], 'Add Page');
    $this->drupalGet('admin/structure/views/nojs/display/test_view/page_2/path');
    $this->submitForm([
        'path' => '<object>malformed_path</object>',
    ], 'Apply');
    $this->submitForm([], 'Add Page');
    $this->drupalGet('admin/structure/views/nojs/display/test_view/page_3/path');
    $this->submitForm([
        'path' => '<script>alert("hello");</script>',
    ], 'Apply');
    $this->submitForm([], 'Add Page');
    $this->drupalGet('admin/structure/views/nojs/display/test_view/page_4/path');
    $this->submitForm([
        'path' => '<script>alert("hello I have placeholders %");</script>',
    ], 'Apply');
    $this->drupalGet('admin/structure/views/view/test_view');
    $this->submitForm([], 'Save');
    $this->drupalGet('admin/structure/views');
    // The anchor text should be escaped.
    $this->assertSession()
        ->assertEscaped('/<object>malformed_path</object>');
    $this->assertSession()
        ->assertEscaped('/<script>alert("hello");</script>');
    $this->assertSession()
        ->assertEscaped('/<script>alert("hello I have placeholders %");</script>');
    // Links should be url-encoded.
    $this->assertSession()
        ->responseContains('/%3Cobject%3Emalformed_path%3C/object%3E');
    $this->assertSession()
        ->responseContains('/%3Cscript%3Ealert%28%22hello%22%29%3B%3C/script%3E');
}