'en', 'delta' => 1, 'theme' => 'drupal', 'include' => '', ]; return [ [ 'path' => '/js/js_foo.js', 'query' => $query, ], [ 'path' => '/css/css_foo.css', 'query' => $query, ], ]; } /** * Test sanitization of the error message for an invalid asset. * * @throws \Behat\Mink\Exception\ExpectationException */ #[DataProvider('providerAssetUrl')] public function testAssetUrl($path, $query): void { $path = PublicStream::basePath() . $path; $this->drupalGet($path, ['query' => $query]); $this->assertSession()->statusCodeEquals(400); $this->assertSession()->responseContains('library name must include at least one slash'); $this->assertSession()->elementNotExists('xpath', '//img[contains(@onerror, "alert")]'); // Swap the XSS payload into the exclude parameter. $query['exclude'] = $query['include']; $query['include'] = 'foo/bar'; $this->drupalGet($path, ['query' => $query]); $this->assertSession()->statusCodeEquals(400); $this->assertSession()->responseContains('library name must include at least one slash'); $this->assertSession()->elementNotExists('xpath', '//img[contains(@onerror, "alert")]'); } }