View source
<?php
namespace Drupal\system\Tests\Routing;
use Drupal\Core\Url;
use Drupal\simpletest\WebTestBase;
class DestinationTest extends WebTestBase {
public static $modules = [
'system_test',
];
public function testDestination() {
$test_cases = [
[
'input' => 'node',
'output' => 'node',
'message' => "Standard internal example node path is present in the 'destination' parameter.",
],
[
'input' => '/example.com',
'output' => '/example.com',
'message' => 'Internal path with one leading slash is allowed.',
],
[
'input' => '//example.com/test',
'output' => '',
'message' => 'External URL without scheme is not allowed.',
],
[
'input' => 'example:test',
'output' => 'example:test',
'message' => 'Internal URL using a colon is allowed.',
],
[
'input' => 'http://example.com',
'output' => '',
'message' => 'External URL is not allowed.',
],
[
'input' => 'javascript:alert(0)',
'output' => 'javascript:alert(0)',
'message' => 'Javascript URL is allowed because it is treated as an internal URL.',
],
];
foreach ($test_cases as $test_case) {
$this
->drupalGet('system-test/get-destination', [
'query' => [
'destination' => $test_case['input'],
],
]);
$this
->assertIdentical($test_case['output'], $this
->getRawContent(), $test_case['message']);
$post_output = $this
->drupalPost('system-test/request-destination', '*', [
'destination' => $test_case['input'],
]);
$this
->assertIdentical($test_case['output'], $post_output, $test_case['message']);
}
\Drupal::configFactory()
->getEditable('system.site')
->set('page.404', 'system-test/get-destination')
->save();
$this
->drupalGet('http://example.com', [
'external' => FALSE,
]);
$this
->assertResponse(404);
$this
->assertIdentical(Url::fromRoute('<front>')
->toString(), $this
->getRawContent(), 'External URL is not allowed on 404 pages.');
}
}