only in patch2:
unchanged:
--- a/core/modules/system/src/Tests/Form/ModulesListFormWebTest.php
+++ b/core/modules/system/src/Tests/Form/ModulesListFormWebTest.php
@@ -19,7 +19,7 @@ class ModulesListFormWebTest extends WebTestBase {
   /**
    * {@inheritdoc}
    */
-  public static $modules = array('system_test', 'help');
+  public static $modules = array('system_test', 'help', 'module_form_xss_test');
 
   /**
    * {@inheritdoc}
@@ -49,6 +49,9 @@ public function testModuleListForm() {
 
     // Check that system_test's help link was rendered correctly.
     $this->assertFieldByXPath("//a[contains(@href, '/admin/help/system_test') and @title='Help']");
+
+    // Checks for a XSS attack in a module description.
+    $this->assertEscaped('Support module for module form XSS testing. <script>alert("hello");</script>');
   }
 
 }
only in patch2:
unchanged:
--- /dev/null
+++ b/core/modules/system/tests/modules/module_form_xss_test/module_form_xss_test.info.yml
@@ -0,0 +1,6 @@
+name: 'Module form XSS test'
+type: module
+description: 'Support module for module form XSS testing. <script>alert("hello");</script>'
+package: Testing
+version: VERSION
+core: 8.x