MenuLinkSecurityTest.php

Same filename in other branches
  1. 8.9.x core/modules/system/tests/src/Functional/Menu/MenuLinkSecurityTest.php
  2. 10 core/modules/system/tests/src/Functional/Menu/MenuLinkSecurityTest.php
  3. 11.x core/modules/system/tests/src/Functional/Menu/MenuLinkSecurityTest.php

Namespace

Drupal\Tests\system\Functional\Menu

File

core/modules/system/tests/src/Functional/Menu/MenuLinkSecurityTest.php

View source
<?php

namespace Drupal\Tests\system\Functional\Menu;

use Drupal\menu_link_content\Entity\MenuLinkContent;
use Drupal\Tests\BrowserTestBase;

/**
 * Ensures that menu links don't cause XSS issues.
 *
 * @group Menu
 */
class MenuLinkSecurityTest extends BrowserTestBase {
    
    /**
     * {@inheritdoc}
     */
    protected static $modules = [
        'menu_link_content',
        'block',
        'menu_test',
    ];
    
    /**
     * {@inheritdoc}
     */
    protected $defaultTheme = 'stark';
    
    /**
     * Ensures that a menu link does not cause an XSS issue.
     */
    public function testMenuLink() {
        $menu_link_content = MenuLinkContent::create([
            'title' => '<script>alert("Wild animals")</script>',
            'menu_name' => 'tools',
            'link' => [
                'uri' => 'route:<front>',
            ],
        ]);
        $menu_link_content->save();
        $this->drupalPlaceBlock('system_menu_block:tools');
        $this->drupalGet('<front>');
        $this->assertSession()
            ->responseNotContains('<script>alert("Wild animals")</script>');
        $this->assertSession()
            ->responseNotContains('<script>alert("Even more wild animals")</script>');
        $this->assertSession()
            ->assertEscaped('<script>alert("Wild animals")</script>');
        $this->assertSession()
            ->assertEscaped('<script>alert("Even more wild animals")</script>');
    }

}

Classes

Title Deprecated Summary
MenuLinkSecurityTest Ensures that menu links don't cause XSS issues.

Buggy or inaccurate documentation? Please file an issue. Need support? Need help programming? Connect with the Drupal community.