{ "description": "Test `#ask` sanitization of printrequest labels to avoid XSS injection (`wgContLang=en`, `wgLang=en`)", "setup": [ { "namespace": "SMW_NS_PROPERTY", "page": "Has text", "contents": "[[Has type::Text]]" }, { "page": "Example/P0704/1", "contents": "[[Has text::P0704]]" }, { "page": "Example/P0704/Q.1", "contents": "{{#ask: [[Has text::P0704]] |?Has text=Some
')\"> |format=table |limit=1 }}" }, { "page": "Example/P0704/Q.2", "contents": "{{#ask: [[Has text::P0704]] |?Has text=Some ')\"> |format=table |limit=1 }}" } ], "tests": [ { "type": "parser", "about": "#0 (avoid XSS through sanitization)", "subject": "Example/P0704/Q.1", "assert-output": { "to-contain": [ "title=\"Property:Has text\">Some <div onmouseover=\"alert('<?php echo htmlspecialchars($xss) ?>')\">" ] } }, { "type": "parser", "about": "#1 (avoid XSS through sanitization)", "subject": "Example/P0704/Q.2", "assert-output": { "to-contain": [ "title=\"Property:Has text\">Some <a href=\"javascript:alert('<?php echo htmlspecialchars($xss) ?>')\">" ] } } ], "settings": { "wgContLang": "en", "wgLang": "en", "smwgPageSpecialProperties": [ "_MDAT" ] }, "meta": { "version": "2", "is-incomplete": false, "debug": false } }