function SearchCommentTest::testSearchResultsComment in Zircon Profile 8.0

Same name and namespace in other branches

1. 8 core/modules/search/src/Tests/SearchCommentTest.php \Drupal\search\Tests\SearchCommentTest::testSearchResultsComment()

Verify that comments are rendered using proper format in search results.

File

core/modules/search/src/Tests/SearchCommentTest.php, line 90

Contains \Drupal\search\Tests\SearchCommentTest.

Class

SearchCommentTest

Tests integration searching comments.

Namespace

Drupal\search\Tests

Code

function testSearchResultsComment() {
  $node_storage = $this->container
    ->get('entity.manager')
    ->getStorage('node');

  // Create basic_html format that escapes all HTML.
  $basic_html_format = entity_create('filter_format', array(
    'format' => 'basic_html',
    'name' => 'Basic HTML',
    'weight' => 1,
    'filters' => array(
      'filter_html_escape' => array(
        'status' => 1,
      ),
    ),
    'roles' => array(
      RoleInterface::AUTHENTICATED_ID,
    ),
  ));
  $basic_html_format
    ->save();
  $comment_body = 'Test comment body';

  // Make preview optional.
  $field = FieldConfig::loadByName('node', 'article', 'comment');
  $field
    ->setSetting('preview', DRUPAL_OPTIONAL);
  $field
    ->save();

  // Allow anonymous users to search content.
  $edit = array(
    RoleInterface::ANONYMOUS_ID . '[search content]' => 1,
    RoleInterface::ANONYMOUS_ID . '[access comments]' => 1,
    RoleInterface::ANONYMOUS_ID . '[post comments]' => 1,
  );
  $this
    ->drupalPostForm('admin/people/permissions', $edit, t('Save permissions'));

  // Create a node.
  $node = $this
    ->drupalCreateNode(array(
    'type' => 'article',
  ));

  // Post a comment using 'Full HTML' text format.
  $edit_comment = array();
  $edit_comment['subject[0][value]'] = 'Test comment subject';
  $edit_comment['comment_body[0][value]'] = '<h1>' . $comment_body . '</h1>';
  $full_html_format_id = 'full_html';
  $edit_comment['comment_body[0][format]'] = $full_html_format_id;
  $this
    ->drupalPostForm('comment/reply/node/' . $node
    ->id() . '/comment', $edit_comment, t('Save'));

  // Post a comment with an evil script tag in the comment subject and a
  // script tag nearby a keyword in the comment body. Use the 'FULL HTML' text
  // format so the script tag stored.
  $edit_comment2 = array();
  $edit_comment2['subject[0][value]'] = "<script>alert('subjectkeyword');</script>";
  $edit_comment2['comment_body[0][value]'] = "nearbykeyword<script>alert('somethinggeneric');</script>";
  $edit_comment2['comment_body[0][format]'] = $full_html_format_id;
  $this
    ->drupalPostForm('comment/reply/node/' . $node
    ->id() . '/comment', $edit_comment2, t('Save'));

  // Post a comment with a keyword inside an evil script tag in the comment
  // body. Use the 'FULL HTML' text format so the script tag is stored.
  $edit_comment3 = array();
  $edit_comment3['subject[0][value]'] = 'asubject';
  $edit_comment3['comment_body[0][value]'] = "<script>alert('insidekeyword');</script>";
  $edit_comment3['comment_body[0][format]'] = $full_html_format_id;
  $this
    ->drupalPostForm('comment/reply/node/' . $node
    ->id() . '/comment', $edit_comment3, t('Save'));

  // Invoke search index update.
  $this
    ->drupalLogout();
  $this
    ->cronRun();

  // Search for the comment subject.
  $edit = array(
    'keys' => "'" . $edit_comment['subject[0][value]'] . "'",
  );
  $this
    ->drupalPostForm('search/node', $edit, t('Search'));
  $node_storage
    ->resetCache(array(
    $node
      ->id(),
  ));
  $node2 = $node_storage
    ->load($node
    ->id());
  $this
    ->assertText($node2
    ->label(), 'Node found in search results.');
  $this
    ->assertText($edit_comment['subject[0][value]'], 'Comment subject found in search results.');

  // Search for the comment body.
  $edit = array(
    'keys' => "'" . $comment_body . "'",
  );
  $this
    ->drupalPostForm(NULL, $edit, t('Search'));
  $this
    ->assertText($node2
    ->label(), 'Node found in search results.');

  // Verify that comment is rendered using proper format.
  $this
    ->assertText($comment_body, 'Comment body text found in search results.');
  $this
    ->assertNoRaw(t('n/a'), 'HTML in comment body is not hidden.');
  $this
    ->assertNoEscaped($edit_comment['comment_body[0][value]'], 'HTML in comment body is not escaped.');

  // Search for the evil script comment subject.
  $edit = array(
    'keys' => 'subjectkeyword',
  );
  $this
    ->drupalPostForm('search/node', $edit, t('Search'));

  // Verify the evil comment subject is escaped in search results.
  $this
    ->assertRaw('&lt;script&gt;alert(&#039;<strong>subjectkeyword</strong>&#039;);');
  $this
    ->assertNoRaw('<script>');

  // Search for the keyword near the evil script tag in the comment body.
  $edit = [
    'keys' => 'nearbykeyword',
  ];
  $this
    ->drupalPostForm('search/node', $edit, t('Search'));

  // Verify that nearby script tag in the evil comment body is stripped from
  // search results.
  $this
    ->assertRaw('<strong>nearbykeyword</strong>');
  $this
    ->assertNoRaw('<script>');

  // Search for contents inside the evil script tag in the comment body.
  $edit = [
    'keys' => 'insidekeyword',
  ];
  $this
    ->drupalPostForm('search/node', $edit, t('Search'));

  // @todo Verify the actual search results.
  //   https://www.drupal.org/node/2551135
  // Verify there is no script tag in search results.
  $this
    ->assertNoRaw('<script>');

  // Hide comments.
  $this
    ->drupalLogin($this->adminUser);
  $node
    ->set('comment', CommentItemInterface::HIDDEN);
  $node
    ->save();

  // Invoke search index update.
  $this
    ->drupalLogout();
  $this
    ->cronRun();

  // Search for $title.
  $this
    ->drupalPostForm('search/node', $edit, t('Search'));
  $this
    ->assertText(t('Your search yielded no results.'));
}