X-Git-Url: http://aleph1.co.uk/gitweb/?a=blobdiff_plain;ds=sidebyside;f=web%2Fcore%2Fmodules%2Fsystem%2Ftests%2Fmodules%2Fform_test%2Fsrc%2FForm%2FFormTestLabelForm.php;h=a22bf7d092108d232c221294660a4a66a4852b55;hb=0bf8d09d2542548982e81a441b1f16e75873a04f;hp=74c92ab611189480759c6f7bc214cb874a5c0a52;hpb=a2bd1bf0c2c1f1a17d188f4dc0726a45494cefae;p=yaffs-website

diff --git a/web/core/modules/system/tests/modules/form_test/src/Form/FormTestLabelForm.php b/web/core/modules/system/tests/modules/form_test/src/Form/FormTestLabelForm.php
index 74c92ab61..a22bf7d09 100644
--- a/web/core/modules/system/tests/modules/form_test/src/Form/FormTestLabelForm.php
+++ b/web/core/modules/system/tests/modules/form_test/src/Form/FormTestLabelForm.php
@@ -7,9 +7,45 @@ use Drupal\Core\Form\FormStateInterface;
 
 /**
  * A form for testing form labels and required marks.
+ *
+ * @internal
  */
 class FormTestLabelForm extends FormBase {
 
+  /**
+   * An array of elements that render a title.
+   *
+   * @var array
+   */
+  public static $typesWithTitle = [
+    'checkbox',
+    'checkboxes',
+    'color',
+    'date',
+    'datelist',
+    'datetime',
+    'details',
+    'email',
+    'fieldset',
+    'file',
+    'item',
+    'managed_file',
+    'number',
+    'password',
+    'password_confirm',
+    'radio',
+    'radios',
+    'range',
+    'search',
+    'select',
+    'tel',
+    'textarea',
+    'textfield',
+    'text_format',
+    'url',
+    'weight',
+  ];
+
   /**
    * {@inheritdoc}
    */
@@ -123,6 +159,21 @@ class FormTestLabelForm extends FormBase {
       ],
       '#required' => TRUE,
     ];
+
+    foreach (static::$typesWithTitle as $type) {
+      $form['form_' . $type . '_title_no_xss'] = [
+        '#type' => $type,
+        '#title' => "$type <script>alert('XSS')</script> is XSS filtered!",
+      ];
+      // Add keys that are required for some elements to be processed correctly.
+      if (in_array($type, ['checkboxes', 'radios'], TRUE)) {
+        $form['form_' . $type . '_title_no_xss']['#options'] = [];
+      }
+      if ($type === 'datetime') {
+        $form['form_' . $type . '_title_no_xss']['#default_value'] = NULL;
+      }
+    }
+
     return $form;
   }