Problem/Motivation

Test coverage was written for SA-CORE-2026-011, but has not yet been added to core.

Proposed resolution

Add the test coverage.

Remaining tasks

NR.

Issue fork drupal-3633157

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

xjm created an issue. See original summary.

xjm’s picture

xjm
she/her
Primary language English
commented
Status: Active » Needs review

xjm opened merge request !17556

smustgrave’s picture

smustgrave commented
Status: Needs review » Reviewed & tested by the community
Issue tags: +Needs Review Queue Initiative

Reverted https://git.drupalcode.org/project/drupal/-/commit/195e67bc29a4c9662a534...
Ran the tests locally

HTML filter attributes removal -- data-hx-* attributes.
Failed asserting that '<a href="foo" data-hx-on-click="alert(document.domain)">click me!</a>' [ASCII](length: 69) does not contain "alert" [ASCII](length: 5).
/var/www/html/core/tests/Drupal/Tests/Component/Utility/XssTest.php:872
/var/www/html/core/tests/Drupal/Tests/Component/Utility/XssTest.php:147


HTML filter attributes removal -- hx-* attributes.
Failed asserting that '<a href="foo" hx-on-click="alert(document.domain)">click me!</a>' [ASCII](length: 64) does not contain "alert" [ASCII](length: 5).
/var/www/html/core/tests/Drupal/Tests/Component/Utility/XssTest.php:872
/var/www/html/core/tests/Drupal/Tests/Component/Utility/XssTest.php:147

Seems like good test coverage for the 2 new cases.

  • catch committed c85d7b98 on 11.5.x 
    task: #3633157 Add test coverage for SA-CORE-2026-011

By: xjm
By:...

  • catch committed ec186254 on 11.x 
    task: #3633157 Add test coverage for SA-CORE-2026-011

By: xjm
By:...

  • catch committed 641281d5 on 12.0.x 
    task: #3633157 Add test coverage for SA-CORE-2026-011

By: xjm
By:...

  • catch committed 5a224059 on main 
    task: #3633157 Add test coverage for SA-CORE-2026-011

By: xjm
By:...
catch’s picture

catch
he/him
Primary language English
commented
Version: main » 11.5.x-dev
Status: Reviewed & tested by the community » Fixed

Committed/pushed to main and cherry-picked back through to 11.5.x, thanks!

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.