Verified Commit 7529144d authored by catch's avatar catch Committed by Jess
Browse files

task: #3633156 Add test coverage for SA-CORE-2026-012 

By: xjm
By: larowlan
By: mingsong
By: neclimdul
By: smustgrave
(cherry picked from commit 6f03727f)
parent ec88439a

core/modules/layout_builder/tests/src/FunctionalJavascript/ContentPreviewToggleTest.php

+38 −0
Changes for core/modules/layout_builder/tests/src/FunctionalJavascript/ContentPreviewToggleTest.php: 38 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -6,6 +6,9 @@ 


use Drupal\FunctionalJavascriptTests\WebDriverTestBase;

use Drupal\layout_builder\Entity\LayoutBuilderEntityViewDisplay;

use Drupal\layout_builder\Plugin\SectionStorage\OverridesSectionStorage;

use Drupal\layout_builder\Section;

use Drupal\layout_builder\SectionComponent;

use Drupal\Tests\contextual\FunctionalJavascript\ContextualLinkClickTrait;

use Drupal\Tests\system\Traits\OffCanvasTestTrait;

use PHPUnit\Framework\Attributes\Group;
@@ -125,6 +128,41 @@ public function testContentPreviewToggle(): void { 
    $this->assertOrderInPage([$content_preview_body_text, 'Placeholder for the "Links" field']);

  }



  /**

   * Tests that block labels are properly escaped in preview.

   */

  public function testBlockLabelXss(): void {

    $page = $this->getSession()->getPage();

    $node = $this->createNode([

      'type' => 'bundle_for_this_particular_test',

    ]);



    $section = new Section('layout_onecol');

    $component = new SectionComponent(

      \Drupal::service('uuid')->generate(),

      'content',

      [

        'id' => 'user_login_block',

        'label' => '<img src="x" onerror="document.querySelector(\'body\').innerHTML = \'XSS has been triggered\';">',

      ]

    );

    $section->appendComponent($component);

    $node->get(OverridesSectionStorage::FIELD_NAME)->appendSection($section);

    $node->save();



    $this->drupalGet('node/1/layout');

    $page->uncheckField('layout-builder-content-preview');

    $this->assertNotEmpty($this->assertSession()->waitForElementVisible('css', '.layout-builder-block__content-preview-placeholder-label'));

    // Add a micro-sleep here to give the browser a moment to try

    // trigger the XSS.

    usleep(100000);



    // If this is still present after the preview has been enabled, then

    // the XSS has not been triggered.

    $this->assertSession()->elementExists('css', '.layout-builder-block__content-preview-placeholder-label');



  }



  /**

   * Checks if contextual links are working properly.

   *