Search page local task label was an XSS vector—add tests

I'm at DrupalGovCon and working on this test.

This test will fail until the parent issue is committed.

So if I'm understanding whats going on here correctly ... this is passing on the old testbots but is failing on the new testbots, the link https://www.drupal.org/node/3060/qa shows that core IS passing on "PHP 5.5 & MySQL 5.5 12,999 pass"

So I'd like to investigate this further but I do not know how to find out the exact PHP 5.5 versions that are running on the old and new testbots.

After a little prodding on the issue, it seems that it was just non-obvious that when you click "retest" , its ONLY for the old testbot and I had wrongly assumed it would kick off a retest for both. After telling the new testbot to kick-off again against PHP 5.5 all seems to be right with the world.

So this is now fully ready for review & commit.

I've removed the changes at the end of the patch per suggestion from @cilefen

re-rolling last patch that did not apply cleanly to head

1. +++ b/core/modules/search/src/Tests/SearchPageTextTest.php
   @@ -23,11 +23,40 @@ class SearchPageTextTest extends SearchTestBase {
   +
   +  }
   ...
   +
      }
   

   The blank lines before the method close curly brace is not necessary.

2. +++ b/core/modules/search/src/Tests/SearchPageTextTest.php
   @@ -23,11 +23,40 @@ class SearchPageTextTest extends SearchTestBase {
   +    $this->cronRun();
   +
   +    $this->drupalLogout();
   

   I don't think these steps are necessary.

I've updated the patch per the comments from alexpott in #17 and included and interdiff

Here is a new interdiff and patch per feedback on IRC from alexpott

One more patch to fix the syntax error and to remove the admin user ... this should have been in the last patch :(

Changing the component since while this is a regression test against the local task system, the test is under the search module.

Test code looks good and patch seems to have taken all the feedback into account.

Minor additional code comment cleanup I'd suggest:

minor:
"Tests for XSS in search module local menu task label." -> either "menu local task" or just "local task" I think.

it might also be helpful to add a note about where the original bug was fixed

Similar to core/modules/user/src/Tests/UserRegistrationTest.php which has:

 * This is a regression test for https://www.drupal.org/node/2500527 to ensure
 * that the form is not cached on GET requests.

Here is a new interdiff and patch that incorporates the feedback from pwolanin in #22

Thanks, this looks like a good addition to the tests.

Committed 93cb20d and pushed to 8.0.x. Thanks!