View source
<?php
namespace Drupal\Tests\block\Functional;
use Drupal\block_content\Entity\BlockContent;
use Drupal\block_content\Entity\BlockContentType;
use Drupal\Core\Url;
use Drupal\system\Entity\Menu;
use Drupal\Tests\BrowserTestBase;
use Drupal\views\Entity\View;
class BlockXssTest extends BrowserTestBase {
protected static $modules = [
'block',
'block_content',
'menu_ui',
'views',
];
protected $defaultTheme = 'stark';
public function testNoUnexpectedEscaping() {
$this
->drupalLogin($this
->drupalCreateUser([
'administer blocks',
'access administration pages',
]));
$this
->drupalGet(Url::fromRoute('block.admin_display'));
$this
->clickLink('Place block');
$this
->assertSession()
->assertNoEscaped('<');
}
public function testXssInTitle() {
$this->container
->get('module_installer')
->install([
'block_test',
]);
$this
->drupalPlaceBlock('test_xss_title', [
'label' => '<script>alert("XSS label");</script>',
]);
\Drupal::state()
->set('block_test.content', $this
->randomMachineName());
$this
->drupalGet('');
$this
->assertSession()
->responseNotContains('<script>alert("XSS label");</script>');
$this
->drupalLogin($this
->drupalCreateUser([
'administer blocks',
'access administration pages',
]));
$default_theme = $this
->config('system.theme')
->get('default');
$this
->drupalGet('admin/structure/block/list/' . $default_theme);
$this
->assertSession()
->responseNotContains("<script>alert('XSS subject');</script>");
}
public function testXssInCategory() {
$this->container
->get('module_installer')
->install([
'block_test',
]);
$this
->drupalPlaceBlock('test_xss_title');
$this
->drupalLogin($this
->drupalCreateUser([
'administer blocks',
'access administration pages',
]));
$this
->drupalGet(Url::fromRoute('block.admin_display'));
$this
->clickLink('Place block');
$this
->assertSession()
->responseNotContains("<script>alert('XSS category');</script>");
}
public function testBlockXss() {
$this
->drupalLogin($this->rootUser);
$this
->doViewTest();
$this
->doMenuTest();
$this
->doBlockContentTest();
$this
->drupalGet(Url::fromRoute('block.admin_display'));
$this
->clickLink('Place block');
$this
->assertSession()
->responseNotContains('&lt;');
}
protected function doViewTest() {
$view = View::create([
'id' => $this
->randomMachineName(),
'label' => '<script>alert("view1");</script>',
]);
$view
->addDisplay('block');
$view
->save();
$view = View::create([
'id' => $this
->randomMachineName(),
'label' => '<script>alert("view2");</script>',
]);
$view
->addDisplay('block', 'Fish & chips');
$view
->save();
$this
->drupalGet(Url::fromRoute('block.admin_display'));
$this
->clickLink('Place block');
$this
->assertSession()
->assertNoEscaped('<script>alert("view1");</script>:');
$this
->assertSession()
->assertEscaped('<script>alert("view2");</script>:');
$this
->assertSession()
->assertEscaped('<script>alert("view1");</script>');
$this
->assertSession()
->responseNotContains('<script>alert("view1");</script>');
$this
->assertSession()
->assertEscaped('<script>alert("view2");</script>: Fish & chips');
$this
->assertSession()
->responseNotContains('<script>alert("view2");</script>');
$this
->assertSession()
->responseNotContains('Fish & chips');
$this
->assertSession()
->responseNotContains('Fish & chips');
$this
->assertSession()
->responseNotContains('Fish &amp; chips');
}
protected function doMenuTest() {
Menu::create([
'id' => $this
->randomMachineName(),
'label' => '<script>alert("menu");</script>',
])
->save();
$this
->drupalGet(Url::fromRoute('block.admin_display'));
$this
->clickLink('Place block');
$this
->assertSession()
->assertEscaped('<script>alert("menu");</script>');
$this
->assertSession()
->responseNotContains('<script>alert("menu");</script>');
}
protected function doBlockContentTest() {
BlockContentType::create([
'id' => 'basic',
'label' => 'basic',
'revision' => TRUE,
])
->save();
BlockContent::create([
'type' => 'basic',
'info' => '<script>alert("block_content");</script>',
])
->save();
$this
->drupalGet(Url::fromRoute('block.admin_display'));
$this
->clickLink('Place block');
$this
->assertSession()
->assertEscaped('<script>alert("block_content");</script>');
$this
->assertSession()
->responseNotContains('<script>alert("block_content");</script>');
}
}