function LinkGeneratorTest::testGenerateXss

Tests the link method with a script tab.

See also

\Drupal\Core\Utility\LinkGenerator::generate()

File

core/tests/Drupal/Tests/Core/Utility/LinkGeneratorTest.php, line 406

Class

LinkGeneratorTest

@coversDefaultClass \Drupal\Core\Utility\LinkGenerator[[api-linebreak]] @group Utility

Namespace

Code

public function testGenerateXss() : void {
  $this->urlGenerator
    ->expects($this->once())
    ->method('generateFromRoute')
    ->with('test_route_4', [], $this->defaultOptions)
    ->willReturn((new GeneratedUrl())->setGeneratedUrl('/test-route-4'));
  // Test that HTML link text is escaped by default.
  $url = new Url('test_route_4');
  $url->setUrlGenerator($this->urlGenerator);
  $result = $this->linkGenerator
    ->generate("<script>alert('XSS!')</script>", $url);
  $this->assertNoXPathResults('//a[@href="/test-route-4"]/script', (string) $result);
}