<?php

declare(strict_types=1);

namespace Drupal\Tests\node\Functional;

use Drupal\Component\Utility\Html;
use PHPUnit\Framework\Attributes\Group;
use PHPUnit\Framework\Attributes\RunTestsInSeparateProcesses;

/**
 * Tests that dangerous tags in the node title are escaped.
 */
#[Group('node')]
#[RunTestsInSeparateProcesses]
class NodeTitleXSSTest extends NodeTestBase {

  /**
   * {@inheritdoc}
   */
  protected $defaultTheme = 'stark';

  /**
   * Tests XSS functionality with a node entity.
   */
  public function testNodeTitleXSS(): void {
    // Prepare a user to do the stuff.
    $web_user = $this->drupalCreateUser([
      'create page content',
      'edit any page content',
    ]);
    $this->drupalLogin($web_user);

    $xss = '<script>alert("xss")</script>';
    $title = $xss . $this->randomMachineName();
    $edit = [];
    $edit['title[0][value]'] = $title;

    $this->drupalGet('node/add/page');
    $this->submitForm($edit, 'Preview');
    // Verify that harmful tags are escaped when previewing a node.
    $this->assertSession()->responseNotContains($xss);

    $settings = ['title' => $title];
    $node = $this->drupalCreateNode($settings);

    $this->drupalGet('node/' . $node->id());
    // Titles should be escaped.
    $this->assertSession()->responseContains('<title>' . Html::escape($title) . ' | Drupal</title>');
    $this->assertSession()->responseNotContains($xss);

    $this->drupalGet('node/' . $node->id() . '/edit');
    $this->assertSession()->responseNotContains($xss);
  }

}
