Index: core/modules/filter/tests/src/FunctionalJavascript/FilterIntegrationTest.php
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>windows-1252
===================================================================
--- core/modules/filter/tests/src/FunctionalJavascript/FilterIntegrationTest.php	(revision )
+++ core/modules/filter/tests/src/FunctionalJavascript/FilterIntegrationTest.php	(revision )
@@ -0,0 +1,48 @@
+<?php
+
+namespace Drupal\Tests\toolbar\FunctionalJavascript;
+
+use Drupal\FunctionalJavascriptTests\JavascriptTestBase;
+
+/**
+ * Tests the JavaScript functionality of the text filter admin form.
+ *
+ * @group toolbar
+ */
+class FilterIntegrationTest extends JavascriptTestBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  public static $modules = ['filter'];
+
+  /**
+   * Tests if we can exploit JS injection when setting allowed HTML tags.
+   */
+  public function testJSInjection() {
+    $admin_user = $this->drupalCreateUser([
+      'access toolbar',
+      'administer site configuration',
+      'access content overview',
+    ]);
+    $this->drupalLogin($admin_user);
+
+    $this->drupalGet('admin/config/content/formats/manage/restricted_html');
+    $page = $this->getSession()->getPage();
+
+    // Test that javascript is run when adding an img tag with 'onerror'.
+    $allowed_html_field = $page->findById('edit-filters-filter-html-settings-allowed-html');
+    $allowed_html_field->focus();
+    $allowed_html_field->setValue($allowed_html_field->getValue() . ' <img src=x onerror=alert(1)>');
+    $allowed_html_field->blur();
+
+    // TODO: assert something here. But, what exactly to assert?
+    $javascript = <<<JS
+    (function(){
+        return 1 == 1;
+    }());
+JS;
+    $this->assertJsCondition($javascript);
+  }
+
+}