class NodeTitleXSSTestCase

class NodeTitleXSSTestCase extends BackdropWebTestCase {
  /**
   * Tests XSS functionality with a node entity.
   */
  function testNodeTitleXSS() {
    // Prepare a user to do the stuff.
    $web_user = $this->backdropCreateUser(array('create page content', 'edit any page content'));
    $this->backdropLogin($web_user);

    $xss = '<script>alert("xss")</script>';
    $title = $xss . $this->randomName();
    $edit = array("title" => $title);

    $settings = array('title' => $title);
    $node = $this->backdropCreateNode($settings);

    $this->backdropGet('node/' . $node->nid);
    // assertTitle() decodes HTML-entities inside the <title> element.
    $this->assertTitle($edit["title"] . ' | Backdrop CMS', 'Title is displayed when viewing a node.');
    $this->assertNoRaw($xss, 'Harmful tags are escaped when viewing a node.');

    $this->backdropGet('node/' . $node->nid . '/edit');
    $this->assertNoRaw($xss, 'Harmful tags are escaped when editing a node.');
  }
}