function DbLogTest::testOverviewLinks

Make sure HTML tags are filtered out in the log overview links.

File

core/modules/dblog/tests/src/Functional/DbLogTest.php, line 865

Class

DbLogTest

Verifies log entries and user access based on permissions.

Namespace

Code

protected function testOverviewLinks() : void {
  $this->drupalLogin($this->adminUser);
  // cSpell:disable-next-line
  $this->generateLogEntries(1, [
    'message' => "&lt;script&gt;alert('foo');&lt;/script&gt;<strong>Lorem</strong> ipsum dolor sit amet, consectetur adipiscing & elit.",
  ]);
  $this->drupalGet('admin/reports/dblog');
  $this->assertSession()
    ->statusCodeEquals(200);
  // Make sure HTML tags are filtered out.
  $this->assertSession()
    ->responseContains('title="alert(&#039;foo&#039;);Lorem');
  $this->assertSession()
    ->responseNotContains("<script>alert('foo');</script>");
  // Make sure HTML tags are filtered out in admin/reports/dblog/event/ too.
  $this->generateLogEntries(1, [
    'message' => "<script>alert('foo');</script> <strong>Lorem ipsum</strong>",
  ]);
  $query = Database::getConnection()->select('watchdog');
  $query->addExpression('MAX([wid])');
  $wid = $query->execute()
    ->fetchField();
  $this->drupalGet('admin/reports/dblog/event/' . $wid);
  $this->assertSession()
    ->responseNotContains("<script>alert('foo');</script>");
  $this->assertSession()
    ->responseContains("alert('foo'); <strong>Lorem ipsum</strong>");
}