Background information

Problem/Motivation

It would be useful to have tests for this to avoid regressions.

Steps to reproduce

Proposed resolution

Add new scenarios to XssTest.

Remaining tasks

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet

Issue fork drupal-3592099

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

prudloff created an issue. See original summary.

prudloff opened merge request !15880

prudloff’s picture

prudloff commented
Status: Active » Needs review

I reused a patch from the private issue so people who worked on it should be credited.

smustgrave’s picture

smustgrave commented
Status: Needs review » Reviewed & tested by the community

Applied the MR
Reverted the change in commit https://git.drupalcode.org/project/drupal/-/commit/55422ceacc40e5cfac746...

Got


Failed asserting that two strings are identical.
Expected :'<a>I'm magic, click me!</a>'
Actual   :'<a -dummy=': href=javascript:alert(&quot;oh\x20no&quot;)//'>I'm magic, click me!</a>'
<Click to see difference>

/var/www/html/core/tests/Drupal/Tests/Component/Utility/XssTest.php:500


Failed asserting that two strings are identical.
Expected :'<a class="good">I'm magic, click me!</a>'
Actual   :'<a class="good" -dummy=': href=javascript:alert(&quot;oh\x20no&quot;)//'>I'm magic, click me!</a>'
<Click to see difference>

/var/www/html/core/tests/Drupal/Tests/Component/Utility/XssTest.php:500


Failed asserting that two strings are identical.
Expected :'<a class="good">I'm magic, click me!</a>'
Actual   :'<a -dummy=': href=javascript:alert(&quot;oh\x20no&quot;)//' class="good">I'm magic, click me!</a>'
<Click to see difference>

/var/www/html/core/tests/Drupal/Tests/Component/Utility/XssTest.php:500


Failed asserting that two strings are identical.
Expected :'<a>I'm magic, click me!</a>'
Actual   :'<a zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz-x=": href=javascript:alert(&quot;oh\x20no&quot;)//">I'm magic, click me!</a>'
<Click to see difference>

/var/www/html/core/tests/Drupal/Tests/Component/Utility/XssTest.php:499


Failed asserting that two strings are identical.
Expected :'<a class="good">I'm magic, click me!</a>'
Actual   :'<a class="good" zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz-x=": href=javascript:alert(&quot;oh\x20no&quot;)//">I'm magic, click me!</a>'
<Click to see difference>

/var/www/html/core/tests/Drupal/Tests/Component/Utility/XssTest.php:499


Failed asserting that two strings are identical.
Expected :'<a class="good">I'm magic, click me!</a>'
Actual   :'<a zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz-x=": href=javascript:alert(&quot;oh\x20no&quot;)//" class="good">I'm magic, click me!</a>'
<Click to see difference>

/var/www/html/core/tests/Drupal/Tests/Component/Utility/XssTest.php:499


Failed asserting that two strings are identical.
Expected :'<a>I'm magic, click me!</a>'
Actual   :'<a zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz-x=": href=javascript:alert(&quot;oh\x20no&quot;)//">I'm magic, click me!</a>'
<Click to see difference>

/var/www/html/core/tests/Drupal/Tests/Component/Utility/XssTest.php:499


Failed asserting that two strings are identical.
Expected :'<a class="good">I'm magic, click me!</a>'
Actual   :'<a class="good" zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz-x=": href=javascript:alert(&quot;oh\x20no&quot;)//">I'm magic, click me!</a>'
<Click to see difference>

/var/www/html/core/tests/Drupal/Tests/Component/Utility/XssTest.php:499


Failed asserting that two strings are identical.
Expected :'<a class="good">I'm magic, click me!</a>'
Actual   :'<a zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz-x=": href=javascript:alert(&quot;oh\x20no&quot;)//" class="good">I'm magic, click me!</a>'
<Click to see difference>

/var/www/html/core/tests/Drupal/Tests/Component/Utility/XssTest.php:499


Failed asserting that two strings are identical.
Expected :'<a>I'm magic, click me!</a>'
Actual   :'<a zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz-x=": href=javascript:alert(&quot;oh\x20no&quot;)//">I'm magic, click me!</a>'
<Click to see difference>

/var/www/html/core/tests/Drupal/Tests/Component/Utility/XssTest.php:499


Failed asserting that two strings are identical.
Expected :'<a class="good">I'm magic, click me!</a>'
Actual   :'<a class="good" zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz-x=": href=javascript:alert(&quot;oh\x20no&quot;)//">I'm magic, click me!</a>'
<Click to see difference>

/var/www/html/core/tests/Drupal/Tests/Component/Utility/XssTest.php:499


Failed asserting that two strings are identical.
Expected :'<a class="good">I'm magic, click me!</a>'
Actual   :'<a zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz-x=": href=javascript:alert(&quot;oh\x20no&quot;)//" class="good">I'm magic, click me!</a>'
<Click to see difference>

/var/www/html/core/tests/Drupal/Tests/Component/Utility/XssTest.php:499

Believe this is showing the test coverage.

alexpott’s picture

alexpott
he/they
Primary language English
Location 🇪🇺🌍
commented
Version: main » 11.4.x-dev
Status: Reviewed & tested by the community » Fixed

Committed b76ac23 and pushed to main. Thanks!
Committed f415032 and pushed to 11.x. Thanks!
Committed 9b401a6 and pushed to 11.4.x. Thanks!

Backported to 11.4.x as a test-only fix.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

  • alexpott committed 9b401a64 on 11.4.x 
    task: #3592099 Add tests for SA-CORE-2021-002

By: prudloff
By:...

  • alexpott committed f4150321 on 11.x 
    task: #3592099 Add tests for SA-CORE-2021-002

By: prudloff
By:...

  • alexpott committed b76ac239 on main 
    task: #3592099 Add tests for SA-CORE-2021-002

By: prudloff
By:...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.