test(security): add encodeURIComponent regression tests for AJAX filters

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

Author: somethingwithproof

tests/Security/XssEscapingTest.php

@@ -34,3 +34,20 @@
 	// ENT_QUOTES|ENT_HTML5 encodes single quotes as ' (HTML5 named entity)
 	expect(html_escape("O'Brien"))->toBe('O'Brien');
 });
+
+it('thold.php AJAX filter uses encodeURIComponent for URL params', function () {
+	$src = file_get_contents(realpath(__DIR__ . '/../../thold.php'));
+	// rfilter is base64-encoded then URI-encoded; other params are URI-encoded directly
+	expect($src)->toContain("encodeURIComponent(base64_encode($('#rfilter').val()))");
+	expect($src)->toContain("encodeURIComponent($('#rows').val())");
+});
+
+it('thold_graph.php AJAX filter uses encodeURIComponent for URL params', function () {
+	$src = file_get_contents(realpath(__DIR__ . '/../../thold_graph.php'));
+	expect($src)->toContain('encodeURIComponent');
+});
+
+it('notify_lists.php AJAX filter uses encodeURIComponent for URL params', function () {
+	$src = file_get_contents(realpath(__DIR__ . '/../../notify_lists.php'));
+	expect($src)->toContain('encodeURIComponent');
+});