diff --git a/core/modules/locale/src/Tests/LocaleStringIsSafeTest.php b/core/modules/locale/src/Tests/LocaleStringIsSafeTest.php index ba364c7..14b9c69 100644 --- a/core/modules/locale/src/Tests/LocaleStringIsSafeTest.php +++ b/core/modules/locale/src/Tests/LocaleStringIsSafeTest.php @@ -50,42 +50,51 @@ public function testLocaleStringIsSafe() { } /** - * Test if the token replacement properly mark strings as unsafe before - * outputting them in a twig template. + * Tests if a translated and tokenized string is properly escaped by Twig. */ public function testLocalizedTokenizedString() { $tests_to_do = array( 1 => array( - 'origin' => 'Go to the frontpage', - 'translated' => 'Go to the frontpage', + 'original' => 'Go to the frontpage', 'replaced' => 'Go to the <a href="javascript:alert('Mooooh!');">frontpage</a>', ), 2 => array( - 'origin' => 'Hello [locale_test:security_test2] !', - 'translated' => 'Hello [locale_test:security_test2] !', - 'replaced' => 'Hello <script>alert('Mooooh!');</script> !', + 'original' => 'Hello [locale_test:security_test2]!', + 'replaced' => 'Hello <strong><script>alert('Mooooh!');</script></strong>!', ), ); foreach ($tests_to_do as $i => $test) { - // Pass the origin string to the t() function to get is marked as safe. - $string = t($test['origin']); + $original_string = $test['original']; + $rendered_original_string = \Drupal::theme()->render('locale_test_tokenized', array('content' => $original_string)); + // Twig assumes that strings are supposed unsafe so it escape them. + $this->assertNotEqual( + $rendered_original_string, + $original_string, + 'Security test ' . $i . ' before translation' + ); + + // Pass the original string to the t() function to get it marked as safe. + $safe_string = t($original_string); + $rendered_safe_string = \Drupal::theme()->render('locale_test_tokenized', array('content' => $safe_string)); // t() function is supposed to mark the string as safe so it won't be // affected by the Twig engine. $this->assertEqual( - \Drupal::theme()->render('locale_test_tokenized', array('content' => $string)), - $test['translated'], - 'Security test ' . $i . ' before token replacement PASS' + $rendered_safe_string, + $original_string, + 'Security test ' . $i . ' after translation before token replacement' ); // Replace tokens in the safe string to inject it dangerous content. - $string = \Drupal::token()->replace($string); - // Token replacement changes the string so it is not marked as safe anymore. - // Result have to be an automatic escaped string. + // @see locale_test_tokens(). + $unsafe_string = \Drupal::token()->replace($safe_string); + $rendered_unsafe_string = \Drupal::theme()->render('locale_test_tokenized', array('content' => $unsafe_string)); + // Token replacement changes the string so it is not marked as safe + // anymore. Result have to be an automatic escaped string. $this->assertEqual( - \Drupal::theme()->render('locale_test_tokenized', array('content' => $string)), + $rendered_unsafe_string, $test['replaced'], - 'Security test ' . $i . ' after token replacement PASS' + 'Security test ' . $i . ' after translation after token replacement' ); } }