', ''];
+ $data[] = ['', '| '];
// DIV background-image.
// @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#DIV_background-image
@@ -447,7 +447,7 @@ public function providerTestFilterXss() {
// BASE tag.
// @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#BASE_tag
- $data[] = ['', ''];
+ $data[] = ['', ''];
// OBJECT tag.
// @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#OBJECT_tag
only in patch2:
unchanged:
--- a/core/modules/field_ui/src/Tests/ManageFieldsTest.php
+++ b/core/modules/field_ui/src/Tests/ManageFieldsTest.php
@@ -653,7 +653,7 @@ public function testExternalDestinations() {
// The external redirect should not fire.
$this->assertUrl('admin/structure/types/manage/article/fields/node.article.body/storage', $options);
$this->assertResponse(200);
- $this->assertRaw('Attempt to update field Body failed: The internal path component 'http://example.com' is external. You are not allowed to specify an external URL together with internal:/..');
+ $this->assertRaw('Attempt to update field Body failed: The internal path component 'http://example.com' is external. You are not allowed to specify an external URL together with internal:/..');
}
/**
only in patch2:
unchanged:
--- a/core/modules/filter/tests/src/Kernel/FilterKernelTest.php
+++ b/core/modules/filter/tests/src/Kernel/FilterKernelTest.php
@@ -532,7 +532,7 @@ public function testHtmlEscapeFilter() {
$tests = [
" One. Two'.\n Three. \n " => [
- "One. <!-- "comment" --> Two'.\n<p>Three.</p>" => TRUE,
+ "One. <!-- "comment" --> Two'.\n<p>Three.</p>" => TRUE,
' One.' => FALSE,
"\n " => FALSE,
],
only in patch2:
unchanged:
--- a/core/modules/locale/tests/src/Kernel/LocaleStringIsSafeTest.php
+++ b/core/modules/locale/tests/src/Kernel/LocaleStringIsSafeTest.php
@@ -54,11 +54,11 @@ public function testLocalizedTokenizedString() {
$tests_to_do = [
1 => [
'original' => 'Go to the frontpage',
- 'replaced' => 'Go to the <a href="javascript:alert('Mooooh!');">frontpage</a>',
+ 'replaced' => 'Go to the <a href="javascript:alert(&'Mooooh!&');">frontpage</a>',
],
2 => [
'original' => 'Hello [locale_test:security_test2]!',
- 'replaced' => 'Hello <strong><script>alert('Mooooh!');</script></strong>!',
+ 'replaced' => 'Hello <strong><script>alert(&'Mooooh!&');</script></strong>!',
],
];
only in patch2:
unchanged:
--- a/core/modules/search/src/Tests/SearchCommentTest.php
+++ b/core/modules/search/src/Tests/SearchCommentTest.php
@@ -172,7 +172,7 @@ public function testSearchResultsComment() {
$this->drupalPostForm('search/node', $edit, t('Search'));
// Verify the evil comment subject is escaped in search results.
- $this->assertRaw('<script>alert('subjectkeyword');');
+ $this->assertRaw('<script>alert('subjectkeyword');');
$this->assertNoRaw(' test"],
- ], "This is <script><em>alert('XSS')</em></script> <strong>test</strong>"];
+ ], "This is <script><em>alert('XSS')</em></script> <strong>test</strong>"];
// XSS filtering by default test.
$data[] = [[
'child' => ['#markup' => "This is test"],
only in patch2:
unchanged:
--- a/core/tests/Drupal/Tests/Core/Template/TwigExtensionTest.php
+++ b/core/tests/Drupal/Tests/Core/Template/TwigExtensionTest.php
@@ -206,7 +206,7 @@ public function testSafeStringEscaping() {
// Ensure objects that do not implement MarkupInterface are escaped.
$string_object = new TwigExtensionTestString("");
- $this->assertSame('<script>alert('here');</script>', $this->systemUnderTest->escapeFilter($twig, $string_object, 'html', 'UTF-8', TRUE));
+ $this->assertSame('<script>alert('here');</script>', $this->systemUnderTest->escapeFilter($twig, $string_object, 'html', 'UTF-8', TRUE));
}
/**
|
|
|
|