Closed (fixed)
Project:
Metatag
Version:
7.x-1.x-dev
Component:
Tests
Priority:
Normal
Category:
Task
Assigned:
Unassigned
Issue tags:
Reporter:
Created:
7 Sep 2016 at 19:51 UTC
Updated:
13 Dec 2016 at 22:24 UTC
Jump to comment: Most recent, Most recent file
Comments
Comment #2
jlandfried commentedHello! I wanted to take a stab at this since I don't have a ton of experience writing tests, so any and all feedback is welcome.
In order to verify that the tests do indeed fail if xss was is not being filtered I temporarily set \Drupal\Component\Utility\Html::escape() and Drupal\Component\Render\PlainTextOutput::renderFromHtml() to both have a method body of
return (string) $text;Thanks! Hopefully this at least a decent start and is not too far off base.
Comment #3
jlandfried commentedComment #4
damienmckennaThanks for putting this together. I tweaked the image meta tag handling a little bit, and the output slightly.
Comment #6
damienmckennaCommitted.
Comment #7
damienmckennaNeeds to be ported to the D7 branch.
Comment #8
damienmckennaSome tests for the page title.
Comment #9
damienmckennaOf course it'd help if I set it to test against the correct branch X-)
Comment #12
damienmckennaThe tests work against the 8.x-1.x branch :) Committed.
Comment #13
damienmckennaBack to needing to be ported.
Comment #14
damienmckennaComment #15
mariodan commentedHere is an attempt at making this xss test ported to the D7 branch. To verify the tests would fail if input was not sanitized, I disabled check_plain temporarily.
Please let me know if I should make any changes.
Thank you!
Comment #16
mariodan commentedComment #18
mariodan commentedHere is that xss test ported to the D7 branch again. It think it was failing before because I created the patch wrong and a new file was not being created when the patch was applied in the test.
Comment #19
mariodan commentedComment #20
damienmckennaBumping this to beta12.
Comment #21
damienmckennaDuh, it was already committed to beta11.
Comment #22
damienmckennaMinor tweaks.
Comment #24
damienmckennaCommitted. Thanks for the backport, @DrupalDano!