drupalGet('/webform/test_element_description');
$this->assertSession()->waitForElement('css', '.js-webform-tooltip-element');
// Check that default editor-supported tags and safe attributes are preserved.
$filtered_markup = $this->filterHtml('Heading
Quote
- Bold italic sub sup Drupal
');
$this->assertEquals('Heading
Quote
- Bold italic sub sup Drupal
', $filtered_markup);
// Check that unsupported tags, event attributes, and unsafe URLs are removed.
$filtered_markup = $this->filterHtml('Text)
Unsafe link');
$this->assertEquals('Text![]()
Unsafe link', $filtered_markup);
$this->assertFalse((bool) $this->getSession()->evaluateScript('window.webformXssExecuted === true || window.webformXssClicked === true'));
// Check that configured allowed tags are used by the JavaScript filter.
\Drupal::configFactory()
->getEditable('webform.settings')
->set('element.allowed_tags', 'a h2 span')
->save();
$this->drupalGet('/webform/test_element_description');
$this->assertSession()->waitForElement('css', '.js-webform-tooltip-element');
$filtered_markup = $this->filterHtml('TextEmphasisDrupal');
\Drupal::configFactory()
->getEditable('webform.settings')
->set('element.allowed_tags', 'admin')
->save();
$this->assertEquals('TextEmphasisDrupal', $filtered_markup);
}
/**
* Filters HTML using Webform's JavaScript XSS helper.
*
* @param string $html
* The HTML to filter.
*
* @return string
* The filtered HTML.
*/
protected function filterHtml(string $html): string {
$html = json_encode($html);
$script = <<getSession()->evaluateScript($script);
}
}