class LocaleStringIsSafeTest in Drupal 10

Tests locale translation safe string handling.

@group locale

Hierarchy

• class \Drupal\KernelTests\KernelTestBase extends \PHPUnit\Framework\TestCase implements ServiceProviderInterface uses \Drupal\Tests\PhpUnitCompatibilityTrait, \Symfony\Bridge\PhpUnit\ExpectDeprecationTrait, AssertContentTrait, ConfigTestTrait, ExtensionListTestTrait, RandomGeneratorTrait, TestRequirementsTrait, PhpUnitWarnings
  • class \Drupal\Tests\locale\Kernel\LocaleStringIsSafeTest

File

core/modules/locale/tests/src/Kernel/LocaleStringIsSafeTest.php, line 12

Namespace

Drupal\Tests\locale\Kernel

class LocaleStringIsSafeTest extends KernelTestBase {

  /**
   * Modules to enable.
   *
   * @var array
   */
  protected static $modules = [
    'locale',
    'locale_test',
  ];

  /**
   * Tests for locale_string_is_safe().
   */
  public function testLocaleStringIsSafe() {

    // Check a translatable string without HTML.
    $string = 'Hello world!';
    $result = locale_string_is_safe($string);
    $this
      ->assertTrue($result);

    // Check a translatable string which includes trustable HTML.
    $string = 'Hello <strong>world</strong>!';
    $result = locale_string_is_safe($string);
    $this
      ->assertTrue($result);

    // Check an untranslatable string which includes untrustable HTML (according
    // to the locale_string_is_safe() function definition).
    $string = 'Hello <img src="world.png" alt="world" />!';
    $result = locale_string_is_safe($string);
    $this
      ->assertFalse($result);

    // Check a translatable string which includes a token in an href attribute.
    $string = 'Hi <a href="[current-user:url]">user</a>';
    $result = locale_string_is_safe($string);
    $this
      ->assertTrue($result);
  }

  /**
   * Tests if a translated and tokenized string is properly escaped by Twig.
   *
   * In each assert* call we add a new line at the expected result to match the
   * newline at the end of the template file.
   */
  public function testLocalizedTokenizedString() {
    $tests_to_do = [
      1 => [
        'original' => 'Go to the <a href="[locale_test:security_test1]">frontpage</a>',
        'replaced' => 'Go to the &lt;a href=&quot;javascript:alert(&amp;#039;Mooooh!&amp;#039;);&quot;&gt;frontpage&lt;/a&gt;',
      ],
      2 => [
        'original' => 'Hello <strong>[locale_test:security_test2]</strong>!',
        'replaced' => 'Hello &lt;strong&gt;&amp;lt;script&amp;gt;alert(&amp;#039;Mooooh!&amp;#039;);&amp;lt;/script&amp;gt;&lt;/strong&gt;!',
      ],
    ];
    foreach ($tests_to_do as $i => $test) {
      $original_string = $test['original'];
      $rendered_original_string = \Drupal::theme()
        ->render('locale_test_tokenized', [
        'content' => $original_string,
      ]);

      // Twig assumes that strings are unsafe so it escapes them, and so the
      // original and the rendered version should be different.
      $this
        ->assertNotEquals($original_string . "\n", $rendered_original_string, 'Security test ' . $i . ' before translation');

      // Pass the original string to the t() function to get it marked as safe.
      $safe_string = t($original_string);
      $rendered_safe_string = \Drupal::theme()
        ->render('locale_test_tokenized', [
        'content' => $safe_string,
      ]);

      // t() function always marks the string as safe so it won't be escaped,
      // and should be the same as the original.
      $this
        ->assertEquals($original_string . "\n", $rendered_safe_string, 'Security test ' . $i . ' after translation before token replacement');

      // Replace tokens in the safe string to inject it with dangerous content.
      // @see locale_test_tokens().
      $unsafe_string = \Drupal::token()
        ->replace($safe_string);
      $rendered_unsafe_string = \Drupal::theme()
        ->render('locale_test_tokenized', [
        'content' => $unsafe_string,
      ]);

      // Token replacement changes the string so it is not marked as safe
      // anymore. Check it is escaped the way we expect.
      $this
        ->assertEquals($test['replaced'] . "\n", $rendered_unsafe_string, 'Security test ' . $i . ' after translation  after token replacement');
    }
  }

}