SearchCommentTest.php

<?php

declare (strict_types=1);
namespace Drupal\Tests\search\Functional;

use Behat\Mink\Exception\ResponseTextException;
use Drupal\comment\Plugin\Field\FieldType\CommentItemInterface;
use Drupal\comment\Tests\CommentTestTrait;
use Drupal\field\Entity\FieldConfig;
use Drupal\Tests\BrowserTestBase;
use Drupal\Tests\Traits\Core\CronRunTrait;
use Drupal\user\RoleInterface;
use Drupal\filter\Entity\FilterFormat;

/**
 * Tests integration searching comments.
 *
 * @group search
 */
class SearchCommentTest extends BrowserTestBase {
    use CommentTestTrait;
    use CronRunTrait;
    
    /**
     * {@inheritdoc}
     */
    protected static $modules = [
        'filter',
        'node',
        'comment',
        'search',
    ];
    
    /**
     * {@inheritdoc}
     */
    protected $defaultTheme = 'stark';
    
    /**
     * Test subject for comments.
     *
     * @var string
     */
    protected $commentSubject;
    
    /**
     * ID for the administrator role.
     *
     * @var string
     */
    protected $adminRole;
    
    /**
     * A user with various administrative permissions.
     *
     * @var \Drupal\user\UserInterface
     */
    protected $adminUser;
    
    /**
     * Test node for searching.
     *
     * @var \Drupal\node\NodeInterface
     */
    protected $node;
    
    /**
     * {@inheritdoc}
     */
    protected function setUp() : void {
        parent::setUp();
        $this->drupalCreateContentType([
            'type' => 'page',
            'name' => 'Basic page',
        ]);
        $this->drupalCreateContentType([
            'type' => 'article',
            'name' => 'Article',
        ]);
        $full_html_format = FilterFormat::create([
            'format' => 'full_html',
            'name' => 'Full HTML',
            'weight' => 1,
            'filters' => [],
        ]);
        $full_html_format->save();
        // Create and log in an administrative user having access to the Full HTML
        // text format.
        $permissions = [
            'administer filters',
            $full_html_format->getPermissionName(),
            'administer permissions',
            'create page content',
            'post comments',
            'skip comment approval',
            'access comments',
        ];
        $this->adminUser = $this->drupalCreateUser($permissions);
        $this->drupalLogin($this->adminUser);
        // Add a comment field.
        $this->addDefaultCommentField('node', 'article');
    }
    
    /**
     * Verify that comments are rendered using proper format in search results.
     */
    public function testSearchResultsComment() : void {
        $node_storage = $this->container
            ->get('entity_type.manager')
            ->getStorage('node');
        // Create basic_html format that escapes all HTML.
        $basic_html_format = FilterFormat::create([
            'format' => 'basic_html',
            'name' => 'Basic HTML',
            'weight' => 1,
            'filters' => [
                'filter_html_escape' => [
                    'status' => 1,
                ],
            ],
            'roles' => [
                RoleInterface::AUTHENTICATED_ID,
            ],
        ]);
        $basic_html_format->save();
        $comment_body = 'Test comment body';
        // Make preview optional.
        $field = FieldConfig::loadByName('node', 'article', 'comment');
        $field->setSetting('preview', DRUPAL_OPTIONAL);
        $field->save();
        // Allow anonymous users to search content.
        $edit = [
            RoleInterface::ANONYMOUS_ID . '[search content]' => 1,
            RoleInterface::ANONYMOUS_ID . '[access comments]' => 1,
            RoleInterface::ANONYMOUS_ID . '[post comments]' => 1,
        ];
        $this->drupalGet('admin/people/permissions');
        $this->submitForm($edit, 'Save permissions');
        // Create a node.
        $node = $this->drupalCreateNode([
            'type' => 'article',
        ]);
        // Post a comment using 'Full HTML' text format.
        $edit_comment = [];
        $edit_comment['subject[0][value]'] = 'Test comment subject';
        $edit_comment['comment_body[0][value]'] = '<h1>' . $comment_body . '</h1>';
        $full_html_format_id = 'full_html';
        $edit_comment['comment_body[0][format]'] = $full_html_format_id;
        $this->drupalGet('comment/reply/node/' . $node->id() . '/comment');
        $this->submitForm($edit_comment, 'Save');
        // Post a comment with an evil script tag in the comment subject and a
        // script tag nearby a keyword in the comment body. Use the 'FULL HTML' text
        // format so the script tag stored.
        $edit_comment2 = [];
        $edit_comment2['subject[0][value]'] = "<script>alert('subject_keyword');</script>";
        $edit_comment2['comment_body[0][value]'] = "nearby-keyword<script>alert('something generic');</script>";
        $edit_comment2['comment_body[0][format]'] = $full_html_format_id;
        $this->drupalGet('comment/reply/node/' . $node->id() . '/comment');
        $this->submitForm($edit_comment2, 'Save');
        // Post a comment with a keyword inside an evil script tag in the comment
        // body. Use the 'FULL HTML' text format so the script tag is stored.
        $edit_comment3 = [];
        $edit_comment3['subject[0][value]'] = 'a subject';
        $edit_comment3['comment_body[0][value]'] = "<script>alert('inside-keyword');</script>";
        $edit_comment3['comment_body[0][format]'] = $full_html_format_id;
        $this->drupalGet('comment/reply/node/' . $node->id() . '/comment');
        $this->submitForm($edit_comment3, 'Save');
        // Invoke search index update.
        $this->drupalLogout();
        $this->cronRun();
        // Search for the comment subject.
        $edit = [
            'keys' => "'" . $edit_comment['subject[0][value]'] . "'",
        ];
        $this->drupalGet('search/node');
        $this->submitForm($edit, 'Search');
        $node_storage->resetCache([
            $node->id(),
        ]);
        $node2 = $node_storage->load($node->id());
        $this->assertSession()
            ->pageTextContains($node2->label());
        $this->assertSession()
            ->pageTextContains($edit_comment['subject[0][value]']);
        // Search for the comment body.
        $edit = [
            'keys' => "'" . $comment_body . "'",
        ];
        $this->submitForm($edit, 'Search');
        $this->assertSession()
            ->pageTextContains($node2->label());
        // Verify that comment is rendered using proper format.
        $this->assertSession()
            ->pageTextContains($comment_body);
        // Verify that HTML in comment body is not hidden.
        $this->assertSession()
            ->pageTextNotContains('n/a');
        $this->assertSession()
            ->assertNoEscaped($edit_comment['comment_body[0][value]']);
        // Search for the evil script comment subject.
        $edit = [
            'keys' => 'subject_keyword',
        ];
        $this->drupalGet('search/node');
        $this->submitForm($edit, 'Search');
        // Verify the evil comment subject is escaped in search results.
        $this->assertSession()
            ->responseContains('&lt;script&gt;alert(&#039;<strong>subject_keyword</strong>&#039;);');
        $this->assertSession()
            ->responseNotContains('<script>');
        // Search for the keyword near the evil script tag in the comment body.
        $edit = [
            'keys' => 'nearby-keyword',
        ];
        $this->drupalGet('search/node');
        $this->submitForm($edit, 'Search');
        // Verify that nearby script tag in the evil comment body is stripped from
        // search results.
        $this->assertSession()
            ->responseContains('<strong>nearby-keyword</strong>');
        $this->assertSession()
            ->responseNotContains('<script>');
        // Search for contents inside the evil script tag in the comment body.
        $edit = [
            'keys' => 'inside-keyword',
        ];
        $this->drupalGet('search/node');
        $this->submitForm($edit, 'Search');
        // @todo Verify the actual search results.
        //   https://www.drupal.org/node/2551135
        // Verify there is no script tag in search results.
        $this->assertSession()
            ->responseNotContains('<script>');
        // Hide comments.
        $this->drupalLogin($this->adminUser);
        $node->set('comment', CommentItemInterface::HIDDEN);
        $node->save();
        // Invoke search index update.
        $this->drupalLogout();
        $this->cronRun();
        // Search for $title.
        $this->drupalGet('search/node');
        $this->submitForm($edit, 'Search');
        $this->assertSession()
            ->pageTextContains('Your search yielded no results.');
    }
    
    /**
     * Verify access rules for comment indexing with different permissions.
     */
    public function testSearchResultsCommentAccess() : void {
        $comment_body = 'Test comment body';
        $this->commentSubject = 'Test comment subject';
        $roles = $this->adminUser
            ->getRoles(TRUE);
        $this->adminRole = $roles[0];
        // Create a node.
        // Make preview optional.
        $field = FieldConfig::loadByName('node', 'article', 'comment');
        $field->setSetting('preview', DRUPAL_OPTIONAL);
        $field->save();
        $this->node = $this->drupalCreateNode([
            'type' => 'article',
        ]);
        // Post a comment using 'Full HTML' text format.
        $edit_comment = [];
        $edit_comment['subject[0][value]'] = $this->commentSubject;
        $edit_comment['comment_body[0][value]'] = '<h1>' . $comment_body . '</h1>';
        $this->drupalGet('comment/reply/node/' . $this->node
            ->id() . '/comment');
        $this->submitForm($edit_comment, 'Save');
        $this->drupalLogout();
        $this->setRolePermissions(RoleInterface::ANONYMOUS_ID);
        $this->assertCommentAccess(FALSE, 'Anon user has search permission but no access comments permission, comments should not be indexed');
        $this->setRolePermissions(RoleInterface::ANONYMOUS_ID, TRUE);
        $this->assertCommentAccess(TRUE, 'Anon user has search permission and access comments permission, comments should be indexed');
        $this->drupalLogin($this->adminUser);
        $this->drupalGet('admin/people/permissions');
        // Disable search access for authenticated user to test admin user.
        $this->setRolePermissions(RoleInterface::AUTHENTICATED_ID, FALSE, FALSE);
        $this->setRolePermissions($this->adminRole);
        $this->assertCommentAccess(FALSE, 'Admin user has search permission but no access comments permission, comments should not be indexed');
        $this->drupalGet('node/' . $this->node
            ->id());
        $this->setRolePermissions($this->adminRole, TRUE);
        $this->assertCommentAccess(TRUE, 'Admin user has search permission and access comments permission, comments should be indexed');
        $this->setRolePermissions(RoleInterface::AUTHENTICATED_ID);
        $this->assertCommentAccess(FALSE, 'Authenticated user has search permission but no access comments permission, comments should not be indexed');
        $this->setRolePermissions(RoleInterface::AUTHENTICATED_ID, TRUE);
        $this->assertCommentAccess(TRUE, 'Authenticated user has search permission and access comments permission, comments should be indexed');
        // Verify that access comments permission is inherited from the
        // authenticated role.
        $this->setRolePermissions(RoleInterface::AUTHENTICATED_ID, TRUE, FALSE);
        $this->setRolePermissions($this->adminRole);
        $this->assertCommentAccess(TRUE, 'Admin user has search permission and no access comments permission, but comments should be indexed because admin user inherits authenticated user\'s permission to access comments');
        // Verify that search content permission is inherited from the authenticated
        // role.
        $this->setRolePermissions(RoleInterface::AUTHENTICATED_ID, TRUE, TRUE);
        $this->setRolePermissions($this->adminRole, TRUE, FALSE);
        $this->assertCommentAccess(TRUE, 'Admin user has access comments permission and no search permission, but comments should be indexed because admin user inherits authenticated user\'s permission to search');
    }
    
    /**
     * Set permissions for role.
     */
    public function setRolePermissions($rid, $access_comments = FALSE, $search_content = TRUE) : void {
        $permissions = [
            'access comments' => $access_comments,
            'search content' => $search_content,
        ];
        user_role_change_permissions($rid, $permissions);
    }
    
    /**
     * Update search index and search for comment.
     *
     * @internal
     */
    public function assertCommentAccess(bool $assume_access, string $message) : void {
        // Invoke search index update.
        \Drupal::service('search.index')->markForReindex('node_search', $this->node
            ->id());
        $this->cronRun();
        // Search for the comment subject.
        $edit = [
            'keys' => "'" . $this->commentSubject . "'",
        ];
        $this->drupalGet('search/node');
        $this->submitForm($edit, 'Search');
        try {
            if ($assume_access) {
                $this->assertSession()
                    ->pageTextContains($this->node
                    ->label());
                $this->assertSession()
                    ->pageTextContains($this->commentSubject);
            }
            else {
                $this->assertSession()
                    ->pageTextContains('Your search yielded no results.');
            }
        } catch (ResponseTextException) {
            $this->fail($message);
        }
    }
    
    /**
     * Verify that 'add new comment' does not appear in search results or index.
     */
    public function testAddNewComment() : void {
        // Create a node with a short body.
        $settings = [
            'type' => 'article',
            'title' => 'short title',
            'body' => [
                [
                    'value' => 'short body text',
                ],
            ],
        ];
        $user = $this->drupalCreateUser([
            'search content',
            'create article content',
            'access content',
            'post comments',
            'access comments',
        ]);
        $this->drupalLogin($user);
        $node = $this->drupalCreateNode($settings);
        // Verify that if you view the node on its own page, 'add new comment'
        // is there.
        $this->drupalGet('node/' . $node->id());
        $this->assertSession()
            ->pageTextContains('Add new comment');
        // Run cron to index this page.
        $this->drupalLogout();
        $this->cronRun();
        // Search for 'comment'. Should be no results.
        $this->drupalLogin($user);
        $this->drupalGet('search/node');
        $this->submitForm([
            'keys' => 'comment',
        ], 'Search');
        $this->assertSession()
            ->pageTextContains('Your search yielded no results');
        // Search for the node title. Should be found, and 'Add new comment' should
        // not be part of the search snippet.
        $this->drupalGet('search/node');
        $this->submitForm([
            'keys' => 'short',
        ], 'Search');
        $this->assertSession()
            ->pageTextContains($node->label());
        $this->assertSession()
            ->pageTextNotContains('Add new comment');
    }

}