diff --git a/core/modules/locale/src/Tests/LocaleStringIsSafeTest.php b/core/modules/locale/src/Tests/LocaleStringIsSafeTest.php
index ba364c7..14b9c69 100644
--- a/core/modules/locale/src/Tests/LocaleStringIsSafeTest.php
+++ b/core/modules/locale/src/Tests/LocaleStringIsSafeTest.php
@@ -50,42 +50,51 @@ public function testLocaleStringIsSafe() {
}
/**
- * Test if the token replacement properly mark strings as unsafe before
- * outputting them in a twig template.
+ * Tests if a translated and tokenized string is properly escaped by Twig.
*/
public function testLocalizedTokenizedString() {
$tests_to_do = array(
1 => array(
- 'origin' => 'Go to the frontpage',
- 'translated' => 'Go to the frontpage',
+ 'original' => 'Go to the frontpage',
'replaced' => 'Go to the <a href="javascript:alert('Mooooh!');">frontpage</a>',
),
2 => array(
- 'origin' => 'Hello [locale_test:security_test2] !',
- 'translated' => 'Hello [locale_test:security_test2] !',
- 'replaced' => 'Hello <script>alert('Mooooh!');</script> !',
+ 'original' => 'Hello [locale_test:security_test2]!',
+ 'replaced' => 'Hello <strong><script>alert('Mooooh!');</script></strong>!',
),
);
foreach ($tests_to_do as $i => $test) {
- // Pass the origin string to the t() function to get is marked as safe.
- $string = t($test['origin']);
+ $original_string = $test['original'];
+ $rendered_original_string = \Drupal::theme()->render('locale_test_tokenized', array('content' => $original_string));
+ // Twig assumes that strings are supposed unsafe so it escape them.
+ $this->assertNotEqual(
+ $rendered_original_string,
+ $original_string,
+ 'Security test ' . $i . ' before translation'
+ );
+
+ // Pass the original string to the t() function to get it marked as safe.
+ $safe_string = t($original_string);
+ $rendered_safe_string = \Drupal::theme()->render('locale_test_tokenized', array('content' => $safe_string));
// t() function is supposed to mark the string as safe so it won't be
// affected by the Twig engine.
$this->assertEqual(
- \Drupal::theme()->render('locale_test_tokenized', array('content' => $string)),
- $test['translated'],
- 'Security test ' . $i . ' before token replacement PASS'
+ $rendered_safe_string,
+ $original_string,
+ 'Security test ' . $i . ' after translation before token replacement'
);
// Replace tokens in the safe string to inject it dangerous content.
- $string = \Drupal::token()->replace($string);
- // Token replacement changes the string so it is not marked as safe anymore.
- // Result have to be an automatic escaped string.
+ // @see locale_test_tokens().
+ $unsafe_string = \Drupal::token()->replace($safe_string);
+ $rendered_unsafe_string = \Drupal::theme()->render('locale_test_tokenized', array('content' => $unsafe_string));
+ // Token replacement changes the string so it is not marked as safe
+ // anymore. Result have to be an automatic escaped string.
$this->assertEqual(
- \Drupal::theme()->render('locale_test_tokenized', array('content' => $string)),
+ $rendered_unsafe_string,
$test['replaced'],
- 'Security test ' . $i . ' after token replacement PASS'
+ 'Security test ' . $i . ' after translation after token replacement'
);
}
}