Initial Drupal 11 with DDEV setup

web/core/modules/editor/tests/modules/editor_private_test/config/install/editor.editor.private_images.yml

@@ -0,0 +1,17 @@
+langcode: en
+status: true
+dependencies:
+  config:
+    - filter.format.private_images
+  module:
+    - editor_test
+format: private_images
+editor: unicorn
+image_upload:
+  status: true
+  scheme: private
+  directory: null
+  max_size: null
+  max_dimensions:
+    width: null
+    height: null

web/core/modules/editor/tests/modules/editor_private_test/config/install/filter.format.private_images.yml

@@ -0,0 +1,23 @@
+langcode: en
+status: true
+dependencies:
+  module:
+    - editor
+name: 'Private images'
+format: private_images
+filters:
+  editor_file_reference:
+    id: editor_file_reference
+    provider: editor
+    status: true
+    weight: 0
+    settings: {  }
+  filter_html:
+    id: filter_html
+    provider: filter
+    status: false
+    weight: -10
+    settings:
+      allowed_html: '<img src alt data-entity-type data-entity-uuid>'
+      filter_html_help: true
+      filter_html_nofollow: false

web/core/modules/editor/tests/modules/editor_private_test/editor_private_test.info.yml

@@ -0,0 +1,8 @@
+name: 'Text Editor Private test'
+type: module
+description: 'Support module for the Text Editor Private module tests.'
+package: Testing
+version: VERSION
+dependencies:
+  - drupal:filter
+  - drupal:editor_test

web/core/modules/editor/tests/modules/editor_test/config/schema/editor_test.schema.yml

@@ -0,0 +1,21 @@
+# Schema for the configuration files of the Editor test module.
+
+editor.settings.unicorn:
+  type: mapping
+  label: 'Unicorn settings'
+  mapping:
+    ponies_too:
+      type: boolean
+      label: 'Ponies too'
+
+editor.settings.trex:
+  type: mapping
+  label: 'T-Rex settings'
+  mapping:
+    stumpy_arms:
+      type: boolean
+      label: 'Stumpy arms'
+
+field.field_settings.editor_test_text_long:
+  label: 'Filter test text (formatted, long) settings'
+  type: field.field_settings.text

web/core/modules/editor/tests/modules/editor_test/editor_test.info.yml

@@ -0,0 +1,7 @@
+name: 'Text Editor test'
+type: module
+description: 'Support module for the Text Editor module tests.'
+package: Testing
+version: VERSION
+dependencies:
+  - drupal:editor

web/core/modules/editor/tests/modules/editor_test/editor_test.libraries.yml

@@ -0,0 +1,8 @@
+unicorn:
+  version: VERSION
+  js:
+    unicorn.js: {}
+trex:
+  version: VERSION
+  js:
+    trex.js: {}

web/core/modules/editor/tests/modules/editor_test/src/EditorXssFilter/Insecure.php

@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\editor_test\EditorXssFilter;
+
+use Drupal\filter\FilterFormatInterface;
+use Drupal\editor\EditorXssFilterInterface;
+
+/**
+ * Defines an insecure text editor XSS filter (for testing purposes).
+ */
+class Insecure implements EditorXssFilterInterface {
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function filterXss($html, FilterFormatInterface $format, ?FilterFormatInterface $original_format = NULL) {
+    // Don't apply any XSS filtering, just return the string we received.
+    return $html;
+  }
+
+}

web/core/modules/editor/tests/modules/editor_test/src/Hook/EditorTestHooks.php

@@ -0,0 +1,99 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\editor_test\Hook;
+
+use Drupal\file\FileInterface;
+use Drupal\filter\FilterFormatInterface;
+use Drupal\node\NodeInterface;
+use Drupal\Core\Entity\EntityInterface;
+use Drupal\Core\Hook\Attribute\Hook;
+
+/**
+ * Hook implementations for editor_test.
+ */
+class EditorTestHooks {
+
+  /**
+   * Implements hook_entity_update().
+   *
+   * @see \Drupal\Tests\editor\Kernel\EntityUpdateTest
+   */
+  #[Hook('entity_update')]
+  public function entityUpdate(EntityInterface $entity): void {
+    // Only act on nodes.
+    if (!$entity instanceof NodeInterface) {
+      return;
+    }
+    // Avoid infinite loop by only going through our post save logic once.
+    if (!empty($entity->editor_test_updating)) {
+      return;
+    }
+    // Set flag for whether or not the entity needs to be resaved.
+    $needs_update = FALSE;
+    // Perform our post save logic.
+    if ($entity->title->value == 'test updated') {
+      // Change the node title.
+      $entity->title->value = 'test updated 2';
+      $needs_update = TRUE;
+    }
+    if ($needs_update) {
+      // Set flag on entity that our logic was already executed.
+      $entity->editor_test_updating = TRUE;
+      // And resave entity.
+      $entity->save();
+    }
+  }
+
+  /**
+   * Implements hook_editor_js_settings_alter().
+   */
+  #[Hook('editor_js_settings_alter')]
+  public function editorJsSettingsAlter(&$settings): void {
+    // Allow tests to enable or disable this alter hook.
+    if (!\Drupal::state()->get('editor_test_js_settings_alter_enabled', FALSE)) {
+      return;
+    }
+    if (isset($settings['editor']['formats']['full_html'])) {
+      $settings['editor']['formats']['full_html']['editorSettings']['ponyModeEnabled'] = FALSE;
+    }
+  }
+
+  /**
+   * Implements hook_editor_xss_filter_alter().
+   */
+  #[Hook('editor_xss_filter_alter')]
+  public function editorXssFilterAlter(&$editor_xss_filter_class, FilterFormatInterface $format, ?FilterFormatInterface $original_format = NULL): void {
+    // Allow tests to enable or disable this alter hook.
+    if (!\Drupal::keyValue('editor_test')->get('editor_xss_filter_alter_enabled', FALSE)) {
+      return;
+    }
+    $filters = $format->filters()->getAll();
+    if (isset($filters['filter_html']) && $filters['filter_html']->status) {
+      $editor_xss_filter_class = '\Drupal\editor_test\EditorXssFilter\Insecure';
+    }
+  }
+
+  /**
+   * Implements hook_editor_info_alter().
+   */
+  #[Hook('editor_info_alter')]
+  public function editorInfoAlter(&$items): void {
+    if (!\Drupal::state()->get('editor_test_give_me_a_trex_thanks', FALSE)) {
+      unset($items['trex']);
+    }
+  }
+
+  /**
+   * Implements hook_ENTITY_TYPE_presave() for file entities.
+   */
+  #[Hook('file_presave')]
+  public function filePresave(FileInterface $file): void {
+    // Use state to keep track of how many times a file is saved.
+    $file_save_count = \Drupal::state()->get('editor_test.file_save_count', []);
+    $file_save_count[$file->getFilename()] = isset($file_save_count[$file->getFilename()]) ? $file_save_count[$file->getFilename()] + 1 : 1;
+    \Drupal::state()->set('editor_test.file_save_count', $file_save_count);
+  }
+
+}

web/core/modules/editor/tests/modules/editor_test/src/Plugin/Editor/TRexEditor.php

@@ -0,0 +1,68 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\editor_test\Plugin\Editor;
+
+use Drupal\Core\Form\FormStateInterface;
+use Drupal\editor\Attribute\Editor;
+use Drupal\editor\Entity\Editor as EditorEntity;
+use Drupal\editor\Plugin\EditorBase;
+use Drupal\Core\StringTranslation\TranslatableMarkup;
+
+/**
+ * Defines a Tyrannosaurus-Rex powered text editor for testing purposes.
+ */
+#[Editor(
+  id: 'trex',
+  label: new TranslatableMarkup('TRex Editor'),
+  supports_content_filtering: TRUE,
+  supports_inline_editing: TRUE,
+  is_xss_safe: FALSE,
+  supported_element_types: [
+    'textarea',
+  ]
+)]
+class TRexEditor extends EditorBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getDefaultSettings() {
+    return ['stumpy_arms' => TRUE];
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function buildConfigurationForm(array $form, FormStateInterface $form_state) {
+    $form['stumpy_arms'] = [
+      '#title' => $this->t('Stumpy arms'),
+      '#type' => 'checkbox',
+      '#default_value' => TRUE,
+    ];
+    return $form;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getJSSettings(EditorEntity $editor) {
+    $js_settings = [];
+    $settings = $editor->getSettings();
+    if ($settings['stumpy_arms']) {
+      $js_settings['doMyArmsLookStumpy'] = TRUE;
+    }
+    return $js_settings;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getLibraries(EditorEntity $editor) {
+    return [
+      'editor_test/trex',
+    ];
+  }
+
+}

web/core/modules/editor/tests/modules/editor_test/src/Plugin/Editor/UnicornEditor.php

@@ -0,0 +1,87 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\editor_test\Plugin\Editor;
+
+use Drupal\Core\Form\FormStateInterface;
+use Drupal\editor\Attribute\Editor;
+use Drupal\editor\Entity\Editor as EditorEntity;
+use Drupal\editor\Plugin\EditorBase;
+use Drupal\Core\StringTranslation\TranslatableMarkup;
+
+/**
+ * Defines a Unicorn-powered text editor for Drupal (for testing purposes).
+ */
+#[Editor(
+  id: 'unicorn',
+  label: new TranslatableMarkup('Unicorn Editor'),
+  supports_content_filtering: TRUE,
+  supports_inline_editing: TRUE,
+  is_xss_safe: FALSE,
+  supported_element_types: [
+    'textarea',
+    'textfield',
+  ]
+)]
+class UnicornEditor extends EditorBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getDefaultSettings() {
+    return ['ponies_too' => TRUE];
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function buildConfigurationForm(array $form, FormStateInterface $form_state) {
+    $form['ponies_too'] = [
+      '#title' => $this->t('Pony mode'),
+      '#type' => 'checkbox',
+      '#default_value' => TRUE,
+    ];
+    $form_state->loadInclude('editor', 'admin.inc');
+    $form['image_upload'] = editor_image_upload_settings_form($form_state->get('editor'));
+    $form['image_upload']['#element_validate'][] = [$this, 'validateImageUploadSettings'];
+    return $form;
+  }
+
+  /**
+   * Render API callback: Image upload handler for confirmation form.
+   *
+   * This function is assigned as a #element_validate callback.
+   *
+   * Moves the text editor's image upload settings into $editor->image_upload.
+   *
+   * @see editor_image_upload_settings_form()
+   */
+  public function validateImageUploadSettings(array $element, FormStateInterface $form_state) {
+    $settings = &$form_state->getValue(['editor', 'settings', 'image_upload']);
+    $form_state->get('editor')->setImageUploadSettings($settings);
+    $form_state->unsetValue(['editor', 'settings', 'image_upload']);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getJSSettings(EditorEntity $editor) {
+    $js_settings = [];
+    $settings = $editor->getSettings();
+    if ($settings['ponies_too']) {
+      $js_settings['ponyModeEnabled'] = TRUE;
+    }
+    return $js_settings;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getLibraries(EditorEntity $editor) {
+    return [
+      'editor_test/unicorn',
+    ];
+  }
+
+}

web/core/modules/editor/tests/modules/editor_test/src/Plugin/Field/FieldType/EditorTestTextLongItem.php

@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\editor_test\Plugin\Field\FieldType;
+
+use Drupal\Core\Field\Attribute\FieldType;
+use Drupal\Core\StringTranslation\TranslatableMarkup;
+use Drupal\text\Plugin\Field\FieldType\TextLongItem;
+
+/**
+ * Plugin implementation of the 'editor_test_text_long' field type.
+ */
+#[FieldType(
+  id: "editor_test_text_long",
+  label: new TranslatableMarkup("Filter test text (formatted, long)"),
+  description: new TranslatableMarkup("This field stores a long text with a text format."),
+  default_widget: "text_textarea",
+  default_formatter: "text_default"
+)]
+class EditorTestTextLongItem extends TextLongItem {
+
+}

web/core/modules/editor/tests/src/Functional/EditorAdminTest.php

@@ -0,0 +1,255 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\Tests\editor\Functional;
+
+use Drupal\Component\Utility\Html;
+use Drupal\filter\Entity\FilterFormat;
+use Drupal\node\Entity\Node;
+use Drupal\node\Entity\NodeType;
+use Drupal\Tests\BrowserTestBase;
+
+/**
+ * Tests administration of text editors.
+ *
+ * @group editor
+ */
+class EditorAdminTest extends BrowserTestBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $modules = ['filter', 'editor'];
+
+  /**
+   * {@inheritdoc}
+   */
+  protected $defaultTheme = 'stark';
+
+  /**
+   * A user with the 'administer filters' permission.
+   *
+   * @var \Drupal\user\UserInterface
+   */
+  protected $adminUser;
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function setUp(): void {
+    parent::setUp();
+
+    // Add text format.
+    $filtered_html_format = FilterFormat::create([
+      'format' => 'filtered_html',
+      'name' => 'Filtered HTML',
+      'weight' => 0,
+      'filters' => [],
+    ]);
+    $filtered_html_format->save();
+
+    // Create admin user.
+    $this->adminUser = $this->drupalCreateUser(['administer filters']);
+  }
+
+  /**
+   * Tests an existing format without any editors available.
+   */
+  public function testNoEditorAvailable(): void {
+    $this->drupalLogin($this->adminUser);
+    $this->drupalGet('admin/config/content/formats/manage/filtered_html');
+
+    // Ensure the form field order is correct.
+    $raw_content = $this->getSession()->getPage()->getContent();
+    $roles_pos = strpos($raw_content, 'Roles');
+    $editor_pos = strpos($raw_content, 'Text editor');
+    $filters_pos = strpos($raw_content, 'Enabled filters');
+    $this->assertGreaterThan($roles_pos, $editor_pos);
+    $this->assertLessThan($filters_pos, $editor_pos);
+
+    // Verify the <select>.
+    $select = $this->assertSession()->selectExists('editor[editor]');
+    $this->assertSame('disabled', $select->getAttribute('disabled'));
+    $options = $select->findAll('css', 'option');
+    $this->assertCount(1, $options);
+    $this->assertSame('None', $options[0]->getText(), 'Option 1 in the Text Editor select is "None".');
+    $this->assertSession()->pageTextContains('This option is disabled because no modules that provide a text editor are currently enabled.');
+  }
+
+  /**
+   * Tests adding a text editor to an existing text format.
+   */
+  public function testAddEditorToExistingFormat(): void {
+    $this->enableUnicornEditor();
+    $this->drupalLogin($this->adminUser);
+    $this->drupalGet('admin/config/content/formats/manage/filtered_html');
+    $edit = $this->selectUnicornEditor();
+    // Configure Unicorn Editor's setting to another value.
+    $edit['editor[settings][ponies_too]'] = FALSE;
+    $this->submitForm($edit, 'Save configuration');
+    $this->verifyUnicornEditorConfiguration('filtered_html', FALSE);
+
+    // Switch back to 'None' and check the Unicorn Editor's settings are gone.
+    $edit = [
+      'editor[editor]' => '',
+    ];
+    $this->submitForm($edit, 'Configure');
+    $this->assertSession()->fieldNotExists('editor[settings][ponies_too]');
+  }
+
+  /**
+   * Tests adding a text editor to a new text format.
+   */
+  public function testAddEditorToNewFormat(): void {
+    $this->addEditorToNewFormat('monoceros', 'Monoceros');
+    $this->verifyUnicornEditorConfiguration('monoceros');
+  }
+
+  /**
+   * Tests format disabling.
+   */
+  public function testDisableFormatWithEditor(): void {
+    $formats = ['monoceros' => 'Monoceros', 'tattoo' => 'Tattoo'];
+
+    // Install the node module.
+    $this->container->get('module_installer')->install(['node']);
+    $this->resetAll();
+    // Create a new node type and attach the 'body' field to it.
+    $node_type = NodeType::create(['type' => $this->randomMachineName(), 'name' => $this->randomString()]);
+    $node_type->save();
+    node_add_body_field($node_type, $this->randomString());
+
+    $permissions = ['administer filters', "edit any {$node_type->id()} content"];
+    foreach ($formats as $format => $name) {
+      // Create a format and add an editor to this format.
+      $this->addEditorToNewFormat($format, $name);
+      // Add permission for this format.
+      $permissions[] = "use text format $format";
+    }
+
+    // Create a node having the body format value 'monoceros'.
+    $node = Node::create([
+      'type' => $node_type->id(),
+      'title' => $this->randomString(),
+    ]);
+    $node->body->value = $this->randomString(100);
+    $node->body->format = 'monoceros';
+    $node->save();
+
+    // Log in as a user able to use both formats and edit nodes of created type.
+    $account = $this->drupalCreateUser($permissions);
+    $this->drupalLogin($account);
+
+    // The node edit page header.
+    $text = sprintf('<em>Edit %s</em> %s', Html::escape($node_type->label()), Html::escape($node->label()));
+
+    // Go to node edit form.
+    $this->drupalGet('node/' . $node->id() . '/edit');
+    $this->assertSession()->responseContains($text);
+
+    // Disable the format assigned to the 'body' field of the node.
+    FilterFormat::load('monoceros')->disable()->save();
+
+    // Edit again the node.
+    $this->drupalGet('node/' . $node->id() . '/edit');
+    $this->assertSession()->responseContains($text);
+  }
+
+  /**
+   * Tests switching text editor to none does not throw a TypeError.
+   */
+  public function testSwitchEditorToNone(): void {
+    $this->enableUnicornEditor();
+    $this->drupalLogin($this->adminUser);
+    $this->drupalGet('admin/config/content/formats/manage/filtered_html');
+    $edit = $this->selectUnicornEditor();
+
+    // Switch editor to 'None'.
+    $edit = [
+      'editor[editor]' => '',
+    ];
+    $this->submitForm($edit, 'Configure');
+    $this->submitForm($edit, 'Save configuration');
+  }
+
+  /**
+   * Adds an editor to a new format using the UI.
+   *
+   * @param string $format_id
+   *   The format id.
+   * @param string $format_name
+   *   The format name.
+   */
+  protected function addEditorToNewFormat($format_id, $format_name): void {
+    $this->enableUnicornEditor();
+    $this->drupalLogin($this->adminUser);
+    $this->drupalGet('admin/config/content/formats/add');
+    // Configure the text format name.
+    $edit = [
+      'name' => $format_name,
+      'format' => $format_id,
+    ];
+    $edit += $this->selectUnicornEditor();
+    $this->submitForm($edit, 'Save configuration');
+  }
+
+  /**
+   * Enables the unicorn editor.
+   */
+  protected function enableUnicornEditor(): void {
+    if (!$this->container->get('module_handler')->moduleExists('editor_test')) {
+      $this->container->get('module_installer')->install(['editor_test']);
+    }
+  }
+
+  /**
+   * Tests and selects the unicorn editor.
+   *
+   * @return array
+   *   Returns an edit array containing the values to be posted.
+   */
+  protected function selectUnicornEditor(): array {
+    // Verify the <select> when a text editor is available.
+    $select = $this->assertSession()->selectExists('editor[editor]');
+    $this->assertFalse($select->hasAttribute('disabled'));
+    $options = $select->findAll('css', 'option');
+    $this->assertCount(2, $options);
+    $this->assertSame('None', $options[0]->getText(), 'Option 1 in the Text Editor select is "None".');
+    $this->assertSame('Unicorn Editor', $options[1]->getText(), 'Option 2 in the Text Editor select is "Unicorn Editor".');
+    $this->assertTrue($options[0]->hasAttribute('selected'), 'Option 1 ("None") is selected.');
+    // Ensure the none option is selected.
+    $this->assertSession()->pageTextNotContains('This option is disabled because no modules that provide a text editor are currently enabled.');
+
+    // Select the "Unicorn Editor" editor and click the "Configure" button.
+    $edit = [
+      'editor[editor]' => 'unicorn',
+    ];
+    $this->submitForm($edit, 'Configure');
+    $this->assertSession()->checkboxChecked('editor[settings][ponies_too]');
+
+    return $edit;
+  }
+
+  /**
+   * Verifies unicorn editor configuration.
+   *
+   * @param string $format_id
+   *   The format machine name.
+   * @param bool $ponies_too
+   *   The expected value of the ponies_too setting.
+   */
+  protected function verifyUnicornEditorConfiguration($format_id, $ponies_too = TRUE): void {
+    $editor = \Drupal::entityTypeManager()->getStorage('editor')->load($format_id);
+    $settings = $editor->getSettings();
+    $this->assertSame('unicorn', $editor->getEditor(), 'The text editor is configured correctly.');
+    $this->assertSame($ponies_too, $settings['ponies_too'], 'The text editor settings are stored correctly.');
+    $this->drupalGet('admin/config/content/formats/manage/' . $format_id);
+    $select = $this->assertSession()->selectExists('editor[editor]');
+    $this->assertFalse($select->hasAttribute('disabled'));
+    $options = $select->findAll('css', 'option');
+    $this->assertCount(2, $options);
+    $this->assertTrue($options[1]->isSelected(), 'Option 2 ("Unicorn Editor") is selected.');
+  }
+
+}

web/core/modules/editor/tests/src/Functional/EditorLoadingTest.php

@@ -0,0 +1,322 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\Tests\editor\Functional;
+
+use Drupal\editor\Entity\Editor;
+use Drupal\field\Entity\FieldConfig;
+use Drupal\field\Entity\FieldStorageConfig;
+use Drupal\filter\Entity\FilterFormat;
+use Drupal\Tests\BrowserTestBase;
+
+/**
+ * Tests loading of text editors.
+ *
+ * @group editor
+ */
+class EditorLoadingTest extends BrowserTestBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $modules = ['filter', 'editor', 'editor_test', 'node'];
+
+  /**
+   * {@inheritdoc}
+   */
+  protected $defaultTheme = 'stark';
+
+  /**
+   * An untrusted user, with access to the 'plain_text' format.
+   *
+   * @var \Drupal\user\UserInterface
+   */
+  protected $untrustedUser;
+
+  /**
+   * A normal user with additional access to the 'filtered_html' format.
+   *
+   * @var \Drupal\user\UserInterface
+   */
+  protected $normalUser;
+
+  /**
+   * A privileged user with additional access to the 'full_html' format.
+   *
+   * @var \Drupal\user\UserInterface
+   */
+  protected $privilegedUser;
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function setUp(): void {
+    parent::setUp();
+
+    // Let there be T-rex.
+    \Drupal::state()->set('editor_test_give_me_a_trex_thanks', TRUE);
+    \Drupal::service('plugin.manager.editor')->clearCachedDefinitions();
+
+    // Add text formats.
+    $filtered_html_format = FilterFormat::create([
+      'format' => 'filtered_html',
+      'name' => 'Filtered HTML',
+      'weight' => 0,
+      'filters' => [],
+    ]);
+    $filtered_html_format->save();
+    $full_html_format = FilterFormat::create([
+      'format' => 'full_html',
+      'name' => 'Full HTML',
+      'weight' => 1,
+      'filters' => [],
+    ]);
+    $full_html_format->save();
+
+    // Create article node type.
+    $this->drupalCreateContentType([
+      'type' => 'article',
+      'name' => 'Article',
+    ]);
+
+    // Create page node type, but remove the body.
+    $this->drupalCreateContentType([
+      'type' => 'page',
+      'name' => 'Page',
+    ]);
+    $body = FieldConfig::loadByName('node', 'page', 'body');
+    $body->delete();
+
+    // Create a formatted text field, which uses an <input type="text">.
+    FieldStorageConfig::create([
+      'field_name' => 'field_text',
+      'entity_type' => 'node',
+      'type' => 'text',
+    ])->save();
+
+    FieldConfig::create([
+      'field_name' => 'field_text',
+      'entity_type' => 'node',
+      'label' => 'Textfield',
+      'bundle' => 'page',
+    ])->save();
+
+    \Drupal::service('entity_display.repository')
+      ->getFormDisplay('node', 'page')
+      ->setComponent('field_text')
+      ->save();
+
+    // Create 3 users, each with access to different text formats.
+    $this->untrustedUser = $this->drupalCreateUser([
+      'create article content',
+      'edit any article content',
+    ]);
+    $this->normalUser = $this->drupalCreateUser([
+      'create article content',
+      'edit any article content',
+      'use text format filtered_html',
+    ]);
+    $this->privilegedUser = $this->drupalCreateUser([
+      'create article content',
+      'edit any article content',
+      'create page content',
+      'edit any page content',
+      'use text format filtered_html',
+      'use text format full_html',
+    ]);
+  }
+
+  /**
+   * Tests loading of text editors.
+   */
+  public function testLoading(): void {
+    // Only associate a text editor with the "Full HTML" text format.
+    $editor = Editor::create([
+      'format' => 'full_html',
+      'editor' => 'unicorn',
+      'image_upload' => [
+        'status' => FALSE,
+      ],
+    ]);
+    $editor->save();
+
+    // The normal user:
+    // - has access to 2 text formats;
+    // - doesn't have access to the full_html text format, so: no text editor.
+    $this->drupalLogin($this->normalUser);
+    $this->drupalGet('node/add/article');
+    [, $editor_settings_present, $editor_js_present, $body] = $this->getThingsToCheck('body');
+    $this->assertFalse($editor_settings_present, 'No Text Editor module settings.');
+    $this->assertFalse($editor_js_present, 'No Text Editor JavaScript.');
+    $this->assertSession()->elementsCount('xpath', $body, 1);
+    $this->assertSession()->elementNotExists('css', 'select.js-filter-list');
+    $this->drupalLogout();
+
+    // The privileged user:
+    // - has access to 2 text formats (and the fallback format);
+    // - does have access to the full_html text format, so: Unicorn text editor.
+    $this->drupalLogin($this->privilegedUser);
+    $this->drupalGet('node/add/article');
+    [$settings, $editor_settings_present, $editor_js_present, $body] = $this->getThingsToCheck('body');
+    $expected = [
+      'formats' => [
+        'full_html' => [
+          'format' => 'full_html',
+          'editor' => 'unicorn',
+          'editorSettings' => ['ponyModeEnabled' => TRUE],
+          'editorSupportsContentFiltering' => TRUE,
+          'isXssSafe' => FALSE,
+        ],
+      ],
+    ];
+    $this->assertTrue($editor_settings_present, "Text Editor module's JavaScript settings are on the page.");
+    $this->assertSame($expected, $settings['editor'], "Text Editor module's JavaScript settings on the page are correct.");
+    $this->assertTrue($editor_js_present, 'Text Editor JavaScript is present.');
+    $this->assertSession()->elementsCount('xpath', $body, 1);
+    $this->assertSession()->elementsCount('css', 'select.js-filter-list', 1);
+    $select = $this->assertSession()->elementExists('css', 'select.js-filter-list');
+    $this->assertSame('edit-body-0-value', $select->getAttribute('data-editor-for'));
+
+    $this->drupalLogout();
+
+    // Also associate a text editor with the "Plain Text" text format.
+    $editor = Editor::create([
+      'format' => 'plain_text',
+      'editor' => 'unicorn',
+      'image_upload' => [
+        'status' => FALSE,
+      ],
+    ]);
+    $editor->save();
+
+    // The untrusted user:
+    // - has access to 1 text format (plain_text);
+    // - has access to the plain_text text format, so: Unicorn text editor.
+    $this->drupalLogin($this->untrustedUser);
+    $this->drupalGet('node/add/article');
+    [$settings, $editor_settings_present, $editor_js_present, $body] = $this->getThingsToCheck('body');
+    $expected = [
+      'formats' => [
+        'plain_text' => [
+          'format' => 'plain_text',
+          'editor' => 'unicorn',
+          'editorSettings' => ['ponyModeEnabled' => TRUE],
+          'editorSupportsContentFiltering' => TRUE,
+          'isXssSafe' => FALSE,
+        ],
+      ],
+    ];
+    $this->assertTrue($editor_settings_present, "Text Editor module's JavaScript settings are on the page.");
+    $this->assertSame($expected, $settings['editor'], "Text Editor module's JavaScript settings on the page are correct.");
+    $this->assertTrue($editor_js_present, 'Text Editor JavaScript is present.');
+    $this->assertSession()->elementsCount('xpath', $body, 1);
+    $this->assertSession()->elementNotExists('css', 'select.js-filter-list');
+    // Verify that a single text format hidden input exists on the page and has
+    // a "data-editor-for" attribute with the correct value.
+    $hidden_input = $this->assertSession()->hiddenFieldExists('body[0][format]');
+    $this->assertSame('plain_text', $hidden_input->getValue());
+    $this->assertSame('edit-body-0-value', $hidden_input->getAttribute('data-editor-for'));
+
+    // Create an "article" node that uses the full_html text format, then try
+    // to let the untrusted user edit it.
+    $this->drupalCreateNode([
+      'type' => 'article',
+      'body' => [
+        ['value' => $this->randomMachineName(32), 'format' => 'full_html'],
+      ],
+    ]);
+
+    // The untrusted user tries to edit content that is written in a text format
+    // that they are not allowed to use. The editor is still loaded. CKEditor,
+    // for example, supports being loaded in a disabled state.
+    $this->drupalGet('node/1/edit');
+    [, $editor_settings_present, $editor_js_present, $body] = $this->getThingsToCheck('body');
+    $this->assertTrue($editor_settings_present, 'Text Editor module settings.');
+    $this->assertTrue($editor_js_present, 'Text Editor JavaScript.');
+    $this->assertSession()->elementsCount('xpath', $body, 1);
+    $this->assertSession()->fieldDisabled("edit-body-0-value");
+    $this->assertSession()->fieldValueEquals("edit-body-0-value", 'This field has been disabled because you do not have sufficient permissions to edit it.');
+    $this->assertSession()->elementNotExists('css', 'select.js-filter-list');
+    // Verify that no single text format hidden input exists on the page.
+    $this->assertSession()->elementNotExists('xpath', '//input[@type="hidden" and contains(@class, "editor")]');
+  }
+
+  /**
+   * Tests supported element types.
+   */
+  public function testSupportedElementTypes(): void {
+    // Associate the unicorn text editor with the "Full HTML" text format.
+    $editor = Editor::create([
+      'format' => 'full_html',
+      'editor' => 'unicorn',
+      'image_upload' => [
+        'status' => FALSE,
+      ],
+    ]);
+    $editor->save();
+
+    // Create a "page" node that uses the full_html text format.
+    $this->drupalCreateNode([
+      'type' => 'page',
+      'field_text' => [
+        ['value' => $this->randomMachineName(32), 'format' => 'full_html'],
+      ],
+    ]);
+
+    // Assert the unicorn editor works with textfields.
+    $this->drupalLogin($this->privilegedUser);
+    $this->drupalGet('node/1/edit');
+    [, $editor_settings_present, $editor_js_present, $field] = $this->getThingsToCheck('field-text', 'input');
+    $this->assertTrue($editor_settings_present, "Text Editor module's JavaScript settings are on the page.");
+    $this->assertTrue($editor_js_present, 'Text Editor JavaScript is present.');
+    $this->assertSession()->elementsCount('xpath', $field, 1);
+    // Verify that a single text format selector exists on the page and has the
+    // "editor" class and a "data-editor-for" attribute with the correct value.
+    $this->assertSession()->elementsCount('css', 'select.js-filter-list', 1);
+    $select = $this->assertSession()->elementExists('css', 'select.js-filter-list');
+    $this->assertStringContainsString('editor', $select->getAttribute('class'));
+    $this->assertSame('edit-field-text-0-value', $select->getAttribute('data-editor-for'));
+
+    // Associate the trex text editor with the "Full HTML" text format.
+    $editor->delete();
+    Editor::create([
+      'format' => 'full_html',
+      'editor' => 'trex',
+      'image_upload' => [
+        'status' => FALSE,
+      ],
+    ])->save();
+
+    $this->drupalGet('node/1/edit');
+    [, $editor_settings_present, $editor_js_present, $field] = $this->getThingsToCheck('field-text', 'input');
+    $this->assertFalse($editor_settings_present, "Text Editor module's JavaScript settings are not on the page.");
+    $this->assertFalse($editor_js_present, 'Text Editor JavaScript is not present.');
+    $this->assertSession()->elementsCount('xpath', $field, 1);
+    // Verify that a single text format selector exists on the page but without
+    // the "editor" class or a "data-editor-for" attribute with the expected
+    // value.
+    $this->assertSession()->elementsCount('css', 'select.js-filter-list', 1);
+    $select = $this->assertSession()->elementExists('css', 'select.js-filter-list');
+    $this->assertStringNotContainsString('editor', $select->getAttribute('class'));
+    $this->assertNotSame('edit-field-text-0-value', $select->getAttribute('data-editor-for'));
+  }
+
+  /**
+   * Gets the information to check for the given field.
+   */
+  protected function getThingsToCheck($field_name, $type = 'textarea'): array {
+    $settings = $this->getDrupalSettings();
+    return [
+      // JavaScript settings.
+      $settings,
+      // Editor.module's JS settings present.
+      isset($settings['editor']),
+      // Editor.module's JS present.
+      str_contains($this->getSession()->getPage()->getContent(), $this->getModulePath('editor') . '/js/editor.js'),
+      // Body field.
+      '//' . $type . '[@id="edit-' . $field_name . '-0-value"]',
+    ];
+  }
+
+}

web/core/modules/editor/tests/src/Functional/EditorPrivateFileReferenceFilterTest.php

@@ -0,0 +1,138 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\Tests\editor\Functional;
+
+use Drupal\file\Entity\File;
+use Drupal\node\NodeInterface;
+use Drupal\Tests\BrowserTestBase;
+use Drupal\user\Entity\Role;
+use Drupal\user\RoleInterface;
+
+/**
+ * Tests Editor module's file reference filter with private files.
+ *
+ * @group editor
+ */
+class EditorPrivateFileReferenceFilterTest extends BrowserTestBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $modules = [
+    'editor_test',
+    // Depends on filter.module (indirectly).
+    'node',
+    // Pulls in the config we're using during testing which create a text format
+    // - with the filter_html_image_secure filter DISABLED,
+    // - with the editor set to Unicorn editor,
+    // - with drupalimage.image_upload.scheme set to 'private',
+    // - with drupalimage.image_upload.directory set to ''.
+    'editor_private_test',
+  ];
+
+  /**
+   * {@inheritdoc}
+   */
+  protected $defaultTheme = 'stark';
+
+  /**
+   * Tests the editor file reference filter with private files.
+   */
+  public function testEditorPrivateFileReferenceFilter(): void {
+    $author = $this->drupalCreateUser();
+    $this->drupalLogin($author);
+
+    // Create a content type with a body field.
+    $this->drupalCreateContentType(['type' => 'page', 'name' => 'Basic page']);
+
+    // Create a file in the 'private:// ' stream.
+    $filename = 'test.png';
+    $src = '/system/files/' . $filename;
+    /** @var \Drupal\file\FileInterface $file */
+    $file = File::create([
+      'uri' => 'private://' . $filename,
+    ]);
+    $file->setTemporary();
+    $file->setOwner($author);
+    // Create the file itself.
+    file_put_contents($file->getFileUri(), $this->randomString());
+    $file->save();
+
+    // The image should be visible for its author.
+    $this->drupalGet($src);
+    $this->assertSession()->statusCodeEquals(200);
+    // The not-yet-permanent image should NOT be visible for anonymous.
+    $this->drupalLogout();
+    $this->drupalGet($src);
+    $this->assertSession()->statusCodeEquals(403);
+
+    // Resave the file to be permanent.
+    $file->setPermanent();
+    $file->save();
+
+    // Create some nodes to ensure file usage count does not match the ID's
+    // of the nodes we are going to check.
+    for ($i = 0; $i < 5; $i++) {
+      $this->drupalCreateNode([
+        'type' => 'page',
+        'uid' => $author->id(),
+      ]);
+    }
+
+    // Create a node with its body field properly pointing to the just-created
+    // file.
+    $published_node = $this->drupalCreateNode([
+      'type' => 'page',
+      'body' => [
+        'value' => '<img alt="alt" data-entity-type="file" data-entity-uuid="' . $file->uuid() . '" src="' . $src . '" />',
+        'format' => 'private_images',
+      ],
+      'uid' => $author->id(),
+    ]);
+
+    // Create an unpublished node with its body field properly pointing to the
+    // just-created file.
+    $unpublished_node = $this->drupalCreateNode([
+      'type' => 'page',
+      'status' => NodeInterface::NOT_PUBLISHED,
+      'body' => [
+        'value' => '<img alt="alt" data-entity-type="file" data-entity-uuid="' . $file->uuid() . '" src="' . $src . '" />',
+        'format' => 'private_images',
+      ],
+      'uid' => $author->id(),
+    ]);
+
+    // Do the actual test. The image should be visible for anonymous users,
+    // because they can view the published node. Even though they can't view
+    // the unpublished node.
+    $this->drupalGet($published_node->toUrl());
+    $this->assertSession()->statusCodeEquals(200);
+    $this->drupalGet($unpublished_node->toUrl());
+    $this->assertSession()->statusCodeEquals(403);
+    $this->drupalGet($src);
+    $this->assertSession()->statusCodeEquals(200);
+
+    // When the published node is also unpublished, the image should also
+    // become inaccessible to anonymous users.
+    $published_node->setUnpublished()->save();
+
+    $this->drupalGet($published_node->toUrl());
+    $this->assertSession()->statusCodeEquals(403);
+    $this->drupalGet($src);
+    $this->assertSession()->statusCodeEquals(403);
+
+    // Disallow anonymous users to view the entity, which then should also
+    // disallow them to view the image.
+    $published_node->setPublished()->save();
+    Role::load(RoleInterface::ANONYMOUS_ID)
+      ->revokePermission('access content')
+      ->save();
+    $this->drupalGet($published_node->toUrl());
+    $this->assertSession()->statusCodeEquals(403);
+    $this->drupalGet($src);
+    $this->assertSession()->statusCodeEquals(403);
+  }
+
+}

web/core/modules/editor/tests/src/Functional/EditorSecurityTest.php

@@ -0,0 +1,457 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\Tests\editor\Functional;
+
+use Drupal\Component\Serialization\Json;
+use Drupal\editor\Entity\Editor;
+use Drupal\filter\Entity\FilterFormat;
+use Drupal\Tests\BrowserTestBase;
+
+/**
+ * Tests XSS protection for content creators when using text editors.
+ *
+ * @group editor
+ */
+class EditorSecurityTest extends BrowserTestBase {
+
+  /**
+   * The sample content to use in all tests.
+   *
+   * @var string
+   */
+  protected static $sampleContent = '<p style="color: red">Hello, Dumbo Octopus!</p><script>alert(0)</script><embed type="image/svg+xml" src="image.svg" />';
+
+  /**
+   * {@inheritdoc}
+   */
+  protected $defaultTheme = 'stark';
+
+  /**
+   * The secured sample content to use in most tests.
+   *
+   * @var string
+   */
+  protected static $sampleContentSecured = '<p>Hello, Dumbo Octopus!</p>alert(0)';
+
+  /**
+   * The secured sample content to use in tests when the <embed> tag is allowed.
+   *
+   * @var string
+   */
+  protected static $sampleContentSecuredEmbedAllowed = '<p>Hello, Dumbo Octopus!</p>alert(0)<embed type="image/svg+xml" src="image.svg" />';
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $modules = ['filter', 'editor', 'editor_test', 'node'];
+
+  /**
+   * User with access to Restricted HTML text format without text editor.
+   *
+   * @var \Drupal\user\UserInterface
+   */
+  protected $untrustedUser;
+
+  /**
+   * User with access to Restricted HTML text format with text editor.
+   *
+   * @var \Drupal\user\UserInterface
+   */
+  protected $normalUser;
+
+  /**
+   * User with access to Restricted HTML and tags considered dangerous.
+   *
+   * @var \Drupal\user\UserInterface
+   */
+  protected $trustedUser;
+
+  /**
+   * User with access to all text formats and text editors.
+   *
+   * @var \Drupal\user\UserInterface
+   */
+  protected $privilegedUser;
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function setUp(): void {
+    parent::setUp();
+
+    // Create 5 text formats, to cover all potential use cases:
+    // 1. restricted_without_editor (untrusted: anonymous)
+    // 2. restricted_with_editor (normal: authenticated)
+    // 3. restricted_plus_dangerous_tag_with_editor (privileged: trusted)
+    // 4. unrestricted_without_editor (privileged: admin)
+    // 5. unrestricted_with_editor (privileged: admin)
+    // With text formats 2, 3 and 5, we also associate a text editor that does
+    // not guarantee XSS safety. "restricted" means the text format has XSS
+    // filters on output, "unrestricted" means the opposite.
+    $format = FilterFormat::create([
+      'format' => 'restricted_without_editor',
+      'name' => 'Restricted HTML, without text editor',
+      'weight' => 0,
+      'filters' => [
+        // A filter of the FilterInterface::TYPE_HTML_RESTRICTOR type.
+        'filter_html' => [
+          'status' => 1,
+          'settings' => [
+            'allowed_html' => '<h2> <h3> <h4> <h5> <h6> <p> <br> <strong> <a>',
+          ],
+        ],
+      ],
+    ]);
+    $format->save();
+    $format = FilterFormat::create([
+      'format' => 'restricted_with_editor',
+      'name' => 'Restricted HTML, with text editor',
+      'weight' => 1,
+      'filters' => [
+        // A filter of the FilterInterface::TYPE_HTML_RESTRICTOR type.
+        'filter_html' => [
+          'status' => 1,
+          'settings' => [
+            'allowed_html' => '<h2> <h3> <h4> <h5> <h6> <p> <br> <strong> <a>',
+          ],
+        ],
+      ],
+    ]);
+    $format->save();
+    $editor = Editor::create([
+      'format' => 'restricted_with_editor',
+      'editor' => 'unicorn',
+      'image_upload' => [
+        'status' => FALSE,
+      ],
+    ]);
+    $editor->save();
+    $format = FilterFormat::create([
+      'format' => 'restricted_plus_dangerous_tag_with_editor',
+      'name' => 'Restricted HTML, dangerous tag allowed, with text editor',
+      'weight' => 1,
+      'filters' => [
+        // A filter of the FilterInterface::TYPE_HTML_RESTRICTOR type.
+        'filter_html' => [
+          'status' => 1,
+          'settings' => [
+            'allowed_html' => '<h2> <h3> <h4> <h5> <h6> <p> <br> <strong> <a> <embed>',
+          ],
+        ],
+      ],
+    ]);
+    $format->save();
+    $editor = Editor::create([
+      'format' => 'restricted_plus_dangerous_tag_with_editor',
+      'editor' => 'unicorn',
+      'image_upload' => [
+        'status' => FALSE,
+      ],
+    ]);
+    $editor->save();
+    $format = FilterFormat::create([
+      'format' => 'unrestricted_without_editor',
+      'name' => 'Unrestricted HTML, without text editor',
+      'weight' => 0,
+      'filters' => [],
+    ]);
+    $format->save();
+    $format = FilterFormat::create([
+      'format' => 'unrestricted_with_editor',
+      'name' => 'Unrestricted HTML, with text editor',
+      'weight' => 1,
+      'filters' => [],
+    ]);
+    $format->save();
+    $editor = Editor::create([
+      'format' => 'unrestricted_with_editor',
+      'editor' => 'unicorn',
+      'image_upload' => [
+        'status' => FALSE,
+      ],
+    ]);
+    $editor->save();
+
+    // Create node type.
+    $this->drupalCreateContentType([
+      'type' => 'article',
+      'name' => 'Article',
+    ]);
+
+    // Create 4 users, each with access to different text formats/editors:
+    // - "untrusted": restricted_without_editor
+    // - "normal": restricted_with_editor,
+    // - "trusted": restricted_plus_dangerous_tag_with_editor
+    // - "privileged": restricted_without_editor, restricted_with_editor,
+    //   restricted_plus_dangerous_tag_with_editor,
+    //   unrestricted_without_editor and unrestricted_with_editor
+    $this->untrustedUser = $this->drupalCreateUser([
+      'create article content',
+      'edit any article content',
+      'use text format restricted_without_editor',
+    ]);
+    $this->normalUser = $this->drupalCreateUser([
+      'create article content',
+      'edit any article content',
+      'use text format restricted_with_editor',
+    ]);
+    $this->trustedUser = $this->drupalCreateUser([
+      'create article content',
+      'edit any article content',
+      'use text format restricted_plus_dangerous_tag_with_editor',
+    ]);
+    $this->privilegedUser = $this->drupalCreateUser([
+      'create article content',
+      'edit any article content',
+      'use text format restricted_without_editor',
+      'use text format restricted_with_editor',
+      'use text format restricted_plus_dangerous_tag_with_editor',
+      'use text format unrestricted_without_editor',
+      'use text format unrestricted_with_editor',
+    ]);
+
+    // Create an "article" node for each possible text format, with the same
+    // sample content, to do our tests on.
+    $samples = [
+      ['author' => $this->untrustedUser->id(), 'format' => 'restricted_without_editor'],
+      ['author' => $this->normalUser->id(), 'format' => 'restricted_with_editor'],
+      ['author' => $this->trustedUser->id(), 'format' => 'restricted_plus_dangerous_tag_with_editor'],
+      ['author' => $this->privilegedUser->id(), 'format' => 'unrestricted_without_editor'],
+      ['author' => $this->privilegedUser->id(), 'format' => 'unrestricted_with_editor'],
+    ];
+    foreach ($samples as $sample) {
+      $this->drupalCreateNode([
+        'type' => 'article',
+        'body' => [
+          ['value' => self::$sampleContent, 'format' => $sample['format']],
+        ],
+        'uid' => $sample['author'],
+      ]);
+    }
+  }
+
+  /**
+   * Tests initial security: is the user safe without switching text formats?
+   *
+   * Tests 8 scenarios. Tests only with a text editor that is not XSS-safe.
+   */
+  public function testInitialSecurity(): void {
+    $expected = [
+      [
+        'node_id' => 1,
+        'format' => 'restricted_without_editor',
+        // No text editor => no XSS filtering.
+        'value' => self::$sampleContent,
+        'users' => [
+          $this->untrustedUser,
+          $this->privilegedUser,
+        ],
+      ],
+      [
+        'node_id' => 2,
+        'format' => 'restricted_with_editor',
+        // Text editor => XSS filtering.
+        'value' => self::$sampleContentSecured,
+        'users' => [
+          $this->normalUser,
+          $this->privilegedUser,
+        ],
+      ],
+      [
+        'node_id' => 3,
+        'format' => 'restricted_plus_dangerous_tag_with_editor',
+        // Text editor => XSS filtering.
+        'value' => self::$sampleContentSecuredEmbedAllowed,
+        'users' => [
+          $this->trustedUser,
+          $this->privilegedUser,
+        ],
+      ],
+      [
+        'node_id' => 4,
+        'format' => 'unrestricted_without_editor',
+        // No text editor => no XSS filtering.
+        'value' => self::$sampleContent,
+        'users' => [
+          $this->privilegedUser,
+        ],
+      ],
+      [
+        'node_id' => 5,
+        'format' => 'unrestricted_with_editor',
+        // Text editor, no security filter => no XSS filtering.
+        'value' => self::$sampleContent,
+        'users' => [
+          $this->privilegedUser,
+        ],
+      ],
+    ];
+
+    // Log in as each user that may edit the content, and assert the value.
+    foreach ($expected as $case) {
+      foreach ($case['users'] as $account) {
+        $this->drupalLogin($account);
+        $this->drupalGet('node/' . $case['node_id'] . '/edit');
+        // Verify that the value is correctly filtered for XSS attack vectors.
+        $this->assertSession()->fieldValueEquals('edit-body-0-value', $case['value']);
+      }
+    }
+  }
+
+  /**
+   * Tests administrator security: is the user safe when switching text formats?
+   *
+   * Tests 24 scenarios. Tests only with a text editor that is not XSS-safe.
+   *
+   * When changing from a more restrictive text format with a text editor (or a
+   * text format without a text editor) to a less restrictive text format, it is
+   * possible that a malicious user could trigger an XSS.
+   *
+   * E.g. when switching a piece of text that uses the Restricted HTML text
+   * format and contains a <script> tag to the Full HTML text format, the
+   * <script> tag would be executed. Unless we apply appropriate filtering.
+   */
+  public function testSwitchingSecurity(): void {
+    $expected = [
+      [
+        'node_id' => 1,
+        // No text editor => no XSS filtering.
+        'value' => self::$sampleContent,
+        'format' => 'restricted_without_editor',
+        'switch_to' => [
+          'restricted_with_editor' => self::$sampleContentSecured,
+          // Intersection of restrictions => most strict XSS filtering.
+          'restricted_plus_dangerous_tag_with_editor' => self::$sampleContentSecured,
+          // No text editor => no XSS filtering.
+          'unrestricted_without_editor' => FALSE,
+          'unrestricted_with_editor' => self::$sampleContentSecured,
+        ],
+      ],
+      [
+        'node_id' => 2,
+        // Text editor => XSS filtering.
+        'value' => self::$sampleContentSecured,
+        'format' => 'restricted_with_editor',
+        'switch_to' => [
+          // No text editor => no XSS filtering.
+          'restricted_without_editor' => FALSE,
+          // Intersection of restrictions => most strict XSS filtering.
+          'restricted_plus_dangerous_tag_with_editor' => self::$sampleContentSecured,
+          // No text editor => no XSS filtering.
+          'unrestricted_without_editor' => FALSE,
+          'unrestricted_with_editor' => self::$sampleContentSecured,
+        ],
+      ],
+      [
+        'node_id' => 3,
+        // Text editor => XSS filtering.
+        'value' => self::$sampleContentSecuredEmbedAllowed,
+        'format' => 'restricted_plus_dangerous_tag_with_editor',
+        'switch_to' => [
+          // No text editor => no XSS filtering.
+          'restricted_without_editor' => FALSE,
+          // Intersection of restrictions => most strict XSS filtering.
+          'restricted_with_editor' => self::$sampleContentSecured,
+          // No text editor => no XSS filtering.
+          'unrestricted_without_editor' => FALSE,
+          // Intersection of restrictions => most strict XSS filtering.
+          'unrestricted_with_editor' => self::$sampleContentSecured,
+        ],
+      ],
+      [
+        'node_id' => 4,
+        // No text editor => no XSS filtering.
+        'value' => self::$sampleContent,
+        'format' => 'unrestricted_without_editor',
+        'switch_to' => [
+          // No text editor => no XSS filtering.
+          'restricted_without_editor' => FALSE,
+          'restricted_with_editor' => self::$sampleContentSecured,
+          // Intersection of restrictions => most strict XSS filtering.
+          'restricted_plus_dangerous_tag_with_editor' => self::$sampleContentSecured,
+          // From no editor, no security filters, to editor, still no security
+          // filters: resulting content when viewed was already vulnerable, so
+          // it must be intentional.
+          'unrestricted_with_editor' => FALSE,
+        ],
+      ],
+      [
+        'node_id' => 5,
+        // Text editor => XSS filtering.
+        'value' => self::$sampleContentSecured,
+        'format' => 'unrestricted_with_editor',
+        'switch_to' => [
+          // From editor, no security filters to security filters, no editor: no
+          // risk.
+          'restricted_without_editor' => FALSE,
+          'restricted_with_editor' => self::$sampleContentSecured,
+          // Intersection of restrictions => most strict XSS filtering.
+          'restricted_plus_dangerous_tag_with_editor' => self::$sampleContentSecured,
+          // From no editor, no security filters, to editor, still no security
+          // filters: resulting content when viewed was already vulnerable, so
+          // it must be intentional.
+          'unrestricted_without_editor' => FALSE,
+        ],
+      ],
+    ];
+
+    // Log in as the privileged user, and for every sample, do the following:
+    // - switch to every other text format/editor
+    // - assert the XSS-filtered values that we get from the server
+    $this->drupalLogin($this->privilegedUser);
+    $cookies = $this->getSessionCookies();
+
+    foreach ($expected as $case) {
+      $this->drupalGet('node/' . $case['node_id'] . '/edit');
+
+      // Verify data- attributes.
+      $body = $this->assertSession()->fieldExists('edit-body-0-value');
+      $this->assertSame(self::$sampleContent, $body->getAttribute('data-editor-value-original'), 'The data-editor-value-original attribute is correctly set.');
+      $this->assertSame('false', (string) $body->getAttribute('data-editor-value-is-changed'), 'The data-editor-value-is-changed attribute is correctly set.');
+
+      // Switch to every other text format/editor and verify the results.
+      foreach ($case['switch_to'] as $format => $expected_filtered_value) {
+        $post = [
+          'value' => self::$sampleContent,
+          'original_format_id' => $case['format'],
+        ];
+        $client = $this->getHttpClient();
+        $response = $client->post($this->buildUrl('/editor/filter_xss/' . $format), [
+          'body' => http_build_query($post),
+          'cookies' => $cookies,
+          'headers' => [
+            'Accept' => 'application/json',
+            'Content-Type' => 'application/x-www-form-urlencoded',
+          ],
+          'http_errors' => FALSE,
+        ]);
+
+        $this->assertEquals(200, $response->getStatusCode());
+
+        $json = Json::decode($response->getBody());
+        $this->assertSame($expected_filtered_value, $json, 'The value was correctly filtered for XSS attack vectors.');
+      }
+    }
+  }
+
+  /**
+   * Tests the standard text editor XSS filter being overridden.
+   */
+  public function testEditorXssFilterOverride(): void {
+    // First: the Standard text editor XSS filter.
+    $this->drupalLogin($this->normalUser);
+    $this->drupalGet('node/2/edit');
+    $this->assertSession()->fieldValueEquals('edit-body-0-value', self::$sampleContentSecured);
+
+    // Enable editor_test's hook_editor_xss_filter_alter() implementation
+    // to alter the text editor XSS filter class being used.
+    \Drupal::keyValue('editor_test')->set('editor_xss_filter_alter_enabled', TRUE);
+
+    // First: the Insecure text editor XSS filter.
+    $this->drupalGet('node/2/edit');
+    $this->assertSession()->fieldValueEquals('edit-body-0-value', self::$sampleContent);
+  }
+
+}

web/core/modules/editor/tests/src/Functional/GenericTest.php

@@ -0,0 +1,14 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\Tests\editor\Functional;
+
+use Drupal\Tests\system\Functional\Module\GenericModuleTestBase;
+
+/**
+ * Generic module test for editor.
+ *
+ * @group editor
+ */
+class GenericTest extends GenericModuleTestBase {}

web/core/modules/editor/tests/src/Functional/Rest/EditorJsonAnonTest.php

@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\Tests\editor\Functional\Rest;
+
+use Drupal\Tests\rest\Functional\AnonResourceTestTrait;
+
+/**
+ * @group rest
+ */
+class EditorJsonAnonTest extends EditorResourceTestBase {
+
+  use AnonResourceTestTrait;
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $format = 'json';
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $mimeType = 'application/json';
+
+  /**
+   * {@inheritdoc}
+   */
+  protected $defaultTheme = 'stark';
+
+}

web/core/modules/editor/tests/src/Functional/Rest/EditorJsonBasicAuthTest.php

@@ -0,0 +1,41 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\Tests\editor\Functional\Rest;
+
+use Drupal\Tests\rest\Functional\BasicAuthResourceTestTrait;
+
+/**
+ * @group rest
+ */
+class EditorJsonBasicAuthTest extends EditorResourceTestBase {
+
+  use BasicAuthResourceTestTrait;
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $modules = ['basic_auth'];
+
+  /**
+   * {@inheritdoc}
+   */
+  protected $defaultTheme = 'stark';
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $format = 'json';
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $mimeType = 'application/json';
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $auth = 'basic_auth';
+
+}

web/core/modules/editor/tests/src/Functional/Rest/EditorJsonCookieTest.php

@@ -0,0 +1,36 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\Tests\editor\Functional\Rest;
+
+use Drupal\Tests\rest\Functional\CookieResourceTestTrait;
+
+/**
+ * @group rest
+ */
+class EditorJsonCookieTest extends EditorResourceTestBase {
+
+  use CookieResourceTestTrait;
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $format = 'json';
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $mimeType = 'application/json';
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $auth = 'cookie';
+
+  /**
+   * {@inheritdoc}
+   */
+  protected $defaultTheme = 'stark';
+
+}

web/core/modules/editor/tests/src/Functional/Rest/EditorResourceTestBase.php

@@ -0,0 +1,148 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\Tests\editor\Functional\Rest;
+
+use Drupal\ckeditor5\Plugin\CKEditor5Plugin\Heading;
+use Drupal\editor\Entity\Editor;
+use Drupal\filter\Entity\FilterFormat;
+use Drupal\Tests\rest\Functional\EntityResource\ConfigEntityResourceTestBase;
+
+/**
+ * Resource test base for Editor entity.
+ */
+abstract class EditorResourceTestBase extends ConfigEntityResourceTestBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $modules = ['ckeditor5', 'editor'];
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $entityTypeId = 'editor';
+
+  /**
+   * The Editor entity.
+   *
+   * @var \Drupal\editor\EditorInterface
+   */
+  protected $entity;
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function setUpAuthorization($method) {
+    $this->grantPermissionsToTestedRole(['administer filters']);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function createEntity() {
+    // Create a "Llama" filter format.
+    $llama_format = FilterFormat::create([
+      'name' => 'Llama',
+      'format' => 'llama',
+      'langcode' => 'es',
+      'filters' => [
+        'filter_html' => [
+          'status' => TRUE,
+          'settings' => [
+            'allowed_html' => '<p> <a> <b> <lo>',
+          ],
+        ],
+      ],
+    ]);
+
+    $llama_format->save();
+
+    // Create a "Camelids" editor.
+    $camelids = Editor::create([
+      'format' => 'llama',
+      'editor' => 'ckeditor5',
+      'image_upload' => [
+        'status' => FALSE,
+      ],
+    ]);
+    $camelids
+      ->setImageUploadSettings([
+        'status' => TRUE,
+        'scheme' => 'public',
+        'directory' => 'inline-images',
+        'max_size' => NULL,
+        'max_dimensions' => [
+          'width' => NULL,
+          'height' => NULL,
+        ],
+      ])
+      ->save();
+
+    return $camelids;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function getExpectedNormalizedEntity() {
+    return [
+      'dependencies' => [
+        'config' => [
+          'filter.format.llama',
+        ],
+        'module' => [
+          'ckeditor5',
+        ],
+      ],
+      'editor' => 'ckeditor5',
+      'format' => 'llama',
+      'image_upload' => [
+        'status' => TRUE,
+        'scheme' => 'public',
+        'directory' => 'inline-images',
+        'max_size' => NULL,
+        'max_dimensions' => [
+          'width' => NULL,
+          'height' => NULL,
+        ],
+      ],
+      'langcode' => 'en',
+      'settings' => [
+        'toolbar' => [
+          'items' => ['heading', 'bold', 'italic'],
+        ],
+        'plugins' => [
+          'ckeditor5_heading' => Heading::DEFAULT_CONFIGURATION,
+        ],
+      ],
+      'status' => TRUE,
+      'uuid' => $this->entity->uuid(),
+    ];
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function getNormalizedPostEntity() {
+    // @todo Update in https://www.drupal.org/node/2300677.
+    return [];
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function getExpectedCacheContexts() {
+    // @see ::createEntity()
+    return ['user.permissions'];
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function getExpectedUnauthorizedAccessMessage($method) {
+    return "The 'administer filters' permission is required.";
+  }
+
+}

web/core/modules/editor/tests/src/Functional/Rest/EditorXmlAnonTest.php

@@ -0,0 +1,33 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\Tests\editor\Functional\Rest;
+
+use Drupal\Tests\rest\Functional\AnonResourceTestTrait;
+use Drupal\Tests\rest\Functional\EntityResource\XmlEntityNormalizationQuirksTrait;
+
+/**
+ * @group rest
+ */
+class EditorXmlAnonTest extends EditorResourceTestBase {
+
+  use AnonResourceTestTrait;
+  use XmlEntityNormalizationQuirksTrait;
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $format = 'xml';
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $mimeType = 'text/xml; charset=UTF-8';
+
+  /**
+   * {@inheritdoc}
+   */
+  protected $defaultTheme = 'stark';
+
+}

web/core/modules/editor/tests/src/Functional/Rest/EditorXmlBasicAuthTest.php

@@ -0,0 +1,43 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\Tests\editor\Functional\Rest;
+
+use Drupal\Tests\rest\Functional\BasicAuthResourceTestTrait;
+use Drupal\Tests\rest\Functional\EntityResource\XmlEntityNormalizationQuirksTrait;
+
+/**
+ * @group rest
+ */
+class EditorXmlBasicAuthTest extends EditorResourceTestBase {
+
+  use BasicAuthResourceTestTrait;
+  use XmlEntityNormalizationQuirksTrait;
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $modules = ['basic_auth'];
+
+  /**
+   * {@inheritdoc}
+   */
+  protected $defaultTheme = 'stark';
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $format = 'xml';
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $mimeType = 'text/xml; charset=UTF-8';
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $auth = 'basic_auth';
+
+}

web/core/modules/editor/tests/src/Functional/Rest/EditorXmlCookieTest.php

@@ -0,0 +1,38 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\Tests\editor\Functional\Rest;
+
+use Drupal\Tests\rest\Functional\CookieResourceTestTrait;
+use Drupal\Tests\rest\Functional\EntityResource\XmlEntityNormalizationQuirksTrait;
+
+/**
+ * @group rest
+ */
+class EditorXmlCookieTest extends EditorResourceTestBase {
+
+  use CookieResourceTestTrait;
+  use XmlEntityNormalizationQuirksTrait;
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $format = 'xml';
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $mimeType = 'text/xml; charset=UTF-8';
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $auth = 'cookie';
+
+  /**
+   * {@inheritdoc}
+   */
+  protected $defaultTheme = 'stark';
+
+}

web/core/modules/editor/tests/src/FunctionalJavascript/EditorAdminTest.php

@@ -0,0 +1,98 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\Tests\editor\FunctionalJavascript;
+
+use Drupal\FunctionalJavascriptTests\WebDriverTestBase;
+
+// cspell:ignore sulaco
+
+/**
+ * @group editor
+ */
+class EditorAdminTest extends WebDriverTestBase {
+
+  /**
+   * The user to use during testing.
+   *
+   * @var \Drupal\user\UserInterface
+   */
+  protected $user;
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $modules = [
+    'editor_test',
+    'ckeditor5',
+  ];
+
+  /**
+   * {@inheritdoc}
+   */
+  protected $defaultTheme = 'stark';
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function setUp(): void {
+    parent::setUp();
+    $this->user = $this->drupalCreateUser([
+      'access administration pages',
+      'administer site configuration',
+      'administer filters',
+    ]);
+    $this->drupalLogin($this->user);
+  }
+
+  /**
+   * Tests that editor selection can be toggled without breaking ajax.
+   */
+  public function testEditorSelection(): void {
+    $page = $this->getSession()->getPage();
+    $assert_session = $this->assertSession();
+
+    $this->drupalGet('/admin/config/content/formats/add');
+    $page->fillField('name', 'Sulaco');
+    // Wait for machine name to be filled in.
+    $this->assertNotEmpty($assert_session->waitForText('sulaco'));
+    $page->selectFieldOption('editor[editor]', 'unicorn');
+    $this->assertNotEmpty($this->assertSession()->waitForField('editor[settings][ponies_too]'));
+    $page->pressButton('Save configuration');
+
+    // Test that toggling the editor selection off and back on works.
+    $this->drupalGet('/admin/config/content/formats/manage/sulaco');
+    // Deselect and reselect an editor.
+    $page->selectFieldOption('editor[editor]', '');
+    $this->assertNotEmpty(
+      $this->assertSession()->waitForElementRemoved('named', ['field', 'editor[settings][ponies_too]']));
+    $page->selectFieldOption('editor[editor]', 'unicorn');
+    $this->assertNotEmpty($this->assertSession()->waitForField('editor[settings][ponies_too]'));
+  }
+
+  /**
+   * Tests that editor creation works fine while switching text editor field.
+   *
+   * The order in which the different editors are selected is significant,
+   * because the form state must change accordingly.
+   *
+   * @see https://www.drupal.org/project/drupal/issues/3230829
+   */
+  public function testEditorCreation(): void {
+    $page = $this->getSession()->getPage();
+
+    $this->drupalGet('/admin/config/content/formats/add');
+    $page->fillField('name', $this->randomString());
+    $page->selectFieldOption('editor[editor]', 'ckeditor5');
+    $this->assertNotEmpty($this->assertSession()->waitForElementVisible('css', 'ul.ckeditor5-toolbar-available__buttons'));
+
+    $page->selectFieldOption('editor[editor]', '');
+    $this->assertNotEmpty($this->assertSession()->waitForElementRemoved('css', 'ul.ckeditor5-toolbar-available__buttons'));
+    $this->assertEmpty($this->assertSession()->waitForField('editor[settings][ponies_too]'));
+
+    $page->selectFieldOption('editor[editor]', 'unicorn');
+    $this->assertNotEmpty($this->assertSession()->waitForField('editor[settings][ponies_too]'));
+  }
+
+}

web/core/modules/editor/tests/src/Kernel/EditorFileReferenceFilterTest.php

@@ -0,0 +1,156 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\Tests\editor\Kernel;
+
+use Drupal\Core\Cache\Cache;
+use Drupal\Core\File\FileExists;
+use Drupal\file\Entity\File;
+use Drupal\filter\FilterPluginCollection;
+use Drupal\KernelTests\KernelTestBase;
+use Drupal\Tests\TestFileCreationTrait;
+
+/**
+ * Tests Editor module's file reference filter.
+ *
+ * @group editor
+ */
+class EditorFileReferenceFilterTest extends KernelTestBase {
+
+  use TestFileCreationTrait;
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $modules = [
+    'system',
+    'filter',
+    'editor',
+    'field',
+    'file',
+    'user',
+  ];
+
+  /**
+   * @var \Drupal\filter\Plugin\FilterInterface[]
+   */
+  protected $filters;
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function setUp(): void {
+    parent::setUp();
+    $this->installConfig(['system']);
+    $this->installEntitySchema('file');
+    $this->installSchema('file', ['file_usage']);
+
+    $manager = $this->container->get('plugin.manager.filter');
+    $bag = new FilterPluginCollection($manager, []);
+    $this->filters = $bag->getAll();
+  }
+
+  /**
+   * Tests the editor file reference filter.
+   */
+  public function testEditorFileReferenceFilter(): void {
+    $filter = $this->filters['editor_file_reference'];
+
+    $test = function ($input) use ($filter) {
+      return $filter->process($input, 'und');
+    };
+
+    file_put_contents('public://llama.jpg', $this->randomMachineName());
+    $image = File::create(['uri' => 'public://llama.jpg']);
+    $image->save();
+    $id = $image->id();
+    $uuid = $image->uuid();
+    $cache_tag = ['file:' . $id];
+
+    file_put_contents('public://alpaca.jpg', $this->randomMachineName());
+    $image_2 = File::create(['uri' => 'public://alpaca.jpg']);
+    $image_2->save();
+    $id_2 = $image_2->id();
+    $uuid_2 = $image_2->uuid();
+    $cache_tag_2 = ['file:' . $id_2];
+
+    // No data-entity-type and no data-entity-uuid attribute.
+    $input = '<img src="llama.jpg" />';
+    $output = $test($input);
+    $this->assertSame($input, $output->getProcessedText());
+
+    // A non-file data-entity-type attribute value.
+    $input = '<img src="llama.jpg" data-entity-type="invalid-entity-type-value" data-entity-uuid="' . $uuid . '" />';
+    $output = $test($input);
+    $this->assertSame($input, $output->getProcessedText());
+
+    // One data-entity-uuid attribute.
+    $input = '<img src="llama.jpg" data-entity-type="file" data-entity-uuid="' . $uuid . '">';
+    $expected_output = '<img src="/' . $this->siteDirectory . '/files/llama.jpg" data-entity-type="file" data-entity-uuid="' . $uuid . '">';
+    $output = $test($input);
+    $this->assertSame($expected_output, $output->getProcessedText());
+    $this->assertEquals($cache_tag, $output->getCacheTags());
+
+    // One data-entity-uuid attribute with odd capitalization.
+    $input = '<img src="llama.jpg" data-entity-type="file" DATA-entity-UUID =   "' . $uuid . '" />';
+    $expected_output = '<img src="/' . $this->siteDirectory . '/files/llama.jpg" data-entity-type="file" data-entity-uuid="' . $uuid . '">';
+    $output = $test($input);
+    $this->assertSame($expected_output, $output->getProcessedText());
+    $this->assertEquals($cache_tag, $output->getCacheTags());
+
+    // One data-entity-uuid attribute on a non-image tag.
+    $input = '<video src="llama.jpg" data-entity-type="file" data-entity-uuid="' . $uuid . '" />';
+    $expected_output = '<video src="/' . $this->siteDirectory . '/files/llama.jpg" data-entity-type="file" data-entity-uuid="' . $uuid . '"></video>';
+    $output = $test($input);
+    $this->assertSame($expected_output, $output->getProcessedText());
+    $this->assertEquals($cache_tag, $output->getCacheTags());
+
+    // One data-entity-uuid attribute with an invalid value.
+    $input = '<img src="llama.jpg" data-entity-type="file" data-entity-uuid="invalid-' . $uuid . '">';
+    $output = $test($input);
+    $this->assertSame($input, $output->getProcessedText());
+    $this->assertEquals([], $output->getCacheTags());
+
+    // Two different data-entity-uuid attributes.
+    $input = '<img src="llama.jpg" data-entity-type="file" data-entity-uuid="' . $uuid . '" />';
+    $input .= '<img src="alpaca.jpg" data-entity-type="file" data-entity-uuid="' . $uuid_2 . '" />';
+    $expected_output = '<img src="/' . $this->siteDirectory . '/files/llama.jpg" data-entity-type="file" data-entity-uuid="' . $uuid . '">';
+    $expected_output .= '<img src="/' . $this->siteDirectory . '/files/alpaca.jpg" data-entity-type="file" data-entity-uuid="' . $uuid_2 . '">';
+    $output = $test($input);
+    $this->assertSame($expected_output, $output->getProcessedText());
+    $this->assertEquals(Cache::mergeTags($cache_tag, $cache_tag_2), $output->getCacheTags());
+
+    // Two identical  data-entity-uuid attributes.
+    $input = '<img src="llama.jpg" data-entity-type="file" data-entity-uuid="' . $uuid . '" />';
+    $input .= '<img src="llama.jpg" data-entity-type="file" data-entity-uuid="' . $uuid . '" />';
+    $expected_output = '<img src="/' . $this->siteDirectory . '/files/llama.jpg" data-entity-type="file" data-entity-uuid="' . $uuid . '">';
+    $expected_output .= '<img src="/' . $this->siteDirectory . '/files/llama.jpg" data-entity-type="file" data-entity-uuid="' . $uuid . '">';
+    $output = $test($input);
+    $this->assertSame($expected_output, $output->getProcessedText());
+    $this->assertEquals($cache_tag, $output->getCacheTags());
+
+    // Add a valid image for image dimension testing.
+    /** @var array stdClass */
+    $files = $this->getTestFiles('image');
+    $image = reset($files);
+    \Drupal::service('file_system')->copy($image->uri, 'public://llama.jpg', FileExists::Replace);
+    [$width, $height] = getimagesize('public://llama.jpg');
+    $dimensions = 'width="' . $width . '" height="' . $height . '"';
+
+    // Image dimensions are present.
+    $input = '<img src="llama.jpg" data-entity-type="file" data-entity-uuid="' . $uuid . '" />';
+    $expected_output = '<img src="/' . $this->siteDirectory . '/files/llama.jpg" data-entity-type="file" data-entity-uuid="' . $uuid . '" ' . $dimensions . '>';
+    $output = $test($input);
+    $this->assertSame($expected_output, $output->getProcessedText());
+    $this->assertEquals($cache_tag, $output->getCacheTags());
+
+    // Image dimensions are set manually.
+    $input = '<img src="llama.jpg" data-entity-type="file" data-entity-uuid="' . $uuid . '"width="41" height="21" />';
+    $expected_output = '<img src="/' . $this->siteDirectory . '/files/llama.jpg" data-entity-type="file" data-entity-uuid="' . $uuid . '" width="41" height="21">';
+    $output = $test($input);
+    $this->assertSame($expected_output, $output->getProcessedText());
+    $this->assertEquals($cache_tag, $output->getCacheTags());
+  }
+
+}

web/core/modules/editor/tests/src/Kernel/EditorFileUsageTest.php

@@ -0,0 +1,295 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\Tests\editor\Kernel;
+
+use Drupal\editor\Entity\Editor;
+use Drupal\KernelTests\Core\Entity\EntityKernelTestBase;
+use Drupal\node\Entity\Node;
+use Drupal\node\Entity\NodeType;
+use Drupal\file\Entity\File;
+use Drupal\field\Entity\FieldConfig;
+use Drupal\field\Entity\FieldStorageConfig;
+use Drupal\Core\Field\FieldStorageDefinitionInterface;
+use Drupal\filter\Entity\FilterFormat;
+
+/**
+ * Tests tracking of file usage by the Text Editor module.
+ *
+ * @group editor
+ */
+class EditorFileUsageTest extends EntityKernelTestBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $modules = ['editor', 'editor_test', 'node', 'file'];
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function setUp(): void {
+    parent::setUp();
+    $this->installEntitySchema('file');
+    $this->installSchema('node', ['node_access']);
+    $this->installSchema('file', ['file_usage']);
+    $this->installConfig(['node']);
+
+    // Add text formats.
+    $filtered_html_format = FilterFormat::create([
+      'format' => 'filtered_html',
+      'name' => 'Filtered HTML',
+      'weight' => 0,
+      'filters' => [],
+    ]);
+    $filtered_html_format->save();
+
+    // Set cardinality for body field.
+    FieldStorageConfig::loadByName('node', 'body')
+      ->setCardinality(FieldStorageDefinitionInterface::CARDINALITY_UNLIMITED)
+      ->save();
+
+    // Set up text editor.
+    $editor = Editor::create([
+      'format' => 'filtered_html',
+      'editor' => 'unicorn',
+      'image_upload' => [
+        'status' => FALSE,
+      ],
+    ]);
+    $editor->save();
+
+    // Create a node type for testing.
+    $type = NodeType::create(['type' => 'page', 'name' => 'page']);
+    $type->save();
+    node_add_body_field($type);
+    FieldStorageConfig::create([
+      'field_name' => 'description',
+      'entity_type' => 'node',
+      'type' => 'editor_test_text_long',
+      'cardinality' => FieldStorageDefinitionInterface::CARDINALITY_UNLIMITED,
+    ])->save();
+    FieldConfig::create([
+      'field_name' => 'description',
+      'entity_type' => 'node',
+      'bundle' => 'page',
+      'label' => 'Description',
+    ])->save();
+  }
+
+  /**
+   * Tests file save operations when node with referenced files is saved.
+   */
+  public function testFileSaveOperations(): void {
+    $permanent_image = File::create([
+      'uri' => 'core/misc/druplicon.png',
+      'status' => 1,
+    ]);
+    $permanent_image->save();
+    $temporary_image = File::create([
+      'uri' => 'core/misc/tree.png',
+      'status' => 0,
+    ]);
+    $temporary_image->save();
+    $body_value = '<img data-entity-type="file" data-entity-uuid="' . $permanent_image->uuid() . '" />';
+    $body_value .= '<img data-entity-type="file" data-entity-uuid="' . $temporary_image->uuid() . '" />';
+    $body[] = [
+      'value' => $body_value,
+      'format' => 'filtered_html',
+    ];
+    $node = Node::create([
+      'type' => 'page',
+      'title' => 'test',
+      'body' => $body,
+      'uid' => 1,
+    ]);
+    $node->save();
+
+    $file_save_count = \Drupal::state()->get('editor_test.file_save_count', []);
+    $this->assertEquals(1, $file_save_count[$permanent_image->getFilename()]);
+    $this->assertEquals(2, $file_save_count[$temporary_image->getFilename()]);
+
+    // Assert both images are now permanent.
+    $permanent_image = File::load($permanent_image->id());
+    $temporary_image = File::load($temporary_image->id());
+    $this->assertTrue($permanent_image->isPermanent(), 'Permanent image was saved as permanent.');
+    $this->assertTrue($temporary_image->isPermanent(), 'Temporary image was saved as permanent.');
+  }
+
+  /**
+   * Tests the configurable text editor manager.
+   */
+  public function testEditorEntityHooks(): void {
+    $image_paths = [
+      0 => 'core/misc/druplicon.png',
+      1 => 'core/misc/tree.png',
+      2 => 'core/misc/help.png',
+    ];
+
+    $image_entities = [];
+    foreach ($image_paths as $key => $image_path) {
+      $image = File::create();
+      $image->setFileUri($image_path);
+      $image->setFilename(\Drupal::service('file_system')->basename($image->getFileUri()));
+      $image->save();
+
+      $file_usage = $this->container->get('file.usage');
+      $this->assertSame([], $file_usage->listUsage($image), 'The image ' . $image_paths[$key] . ' has zero usages.');
+
+      $image_entities[] = $image;
+    }
+
+    $body = [];
+    $description = [];
+    foreach ($image_entities as $key => $image_entity) {
+      // Don't be rude, say hello.
+      $body_value = '<p>Hello, world!</p>';
+      // Test handling of a valid image entry.
+      $body_value .= '<img src="awesome-llama-' . $key . '.jpg" data-entity-type="file" data-entity-uuid="' . $image_entity->uuid() . '" />';
+      // Test handling of an invalid data-entity-uuid attribute.
+      $body_value .= '<img src="awesome-llama-' . $key . '.jpg" data-entity-type="file" data-entity-uuid="invalid-entity-uuid-value" />';
+      // Test handling of an invalid data-entity-type attribute.
+      $body_value .= '<img src="awesome-llama-' . $key . '.jpg" data-entity-type="invalid-entity-type-value" data-entity-uuid="' . $image_entity->uuid() . '" />';
+      // Test handling of a non-existing UUID.
+      $body_value .= '<img src="awesome-llama-' . $key . '.jpg" data-entity-type="file" data-entity-uuid="30aac704-ba2c-40fc-b609-9ed121aa90f4" />';
+
+      $body[] = [
+        'value' => $body_value,
+        'format' => 'filtered_html',
+      ];
+      $description[] = [
+        'value' => 'something',
+        'format' => 'filtered_html',
+      ];
+    }
+
+    // Test editor_entity_insert(): increment.
+    $this->createUser();
+    $node = $node = Node::create([
+      'type' => 'page',
+      'title' => 'test',
+      'body' => $body,
+      'description' => $description,
+      'uid' => 1,
+    ]);
+    $node->save();
+    foreach ($image_entities as $key => $image_entity) {
+      $this->assertSame(['editor' => ['node' => [1 => '1']]], $file_usage->listUsage($image_entity), 'The image ' . $image_paths[$key] . ' has 1 usage.');
+    }
+
+    // Test editor_entity_update(): increment, twice, by creating new revisions.
+    $node->setNewRevision(TRUE);
+    $node->save();
+    $second_revision_id = $node->getRevisionId();
+    $node->setNewRevision(TRUE);
+    $node->save();
+    foreach ($image_entities as $key => $image_entity) {
+      $this->assertSame(['editor' => ['node' => [1 => '3']]], $file_usage->listUsage($image_entity), 'The image ' . $image_paths[$key] . ' has 3 usages.');
+    }
+
+    // Test hook_entity_update(): decrement, by modifying the last revision:
+    // remove the data-entity-type attribute from the body field.
+    $original_values = [];
+    for ($i = 0; $i < count($image_entities); $i++) {
+      $original_value = $node->body[$i]->value;
+      $new_value = str_replace('data-entity-type', 'data-entity-type-modified', $original_value);
+      $node->body[$i]->value = $new_value;
+      $original_values[$i] = $original_value;
+    }
+    $node->save();
+    foreach ($image_entities as $key => $image_entity) {
+      $this->assertSame(['editor' => ['node' => [1 => '2']]], $file_usage->listUsage($image_entity), 'The image ' . $image_paths[$key] . ' has 2 usages.');
+    }
+
+    // Test editor_entity_update(): increment again by creating a new revision:
+    // read the data- attributes to the body field.
+    $node->setNewRevision(TRUE);
+    foreach ($original_values as $key => $original_value) {
+      $node->body[$key]->value = $original_value;
+    }
+    $node->save();
+    foreach ($image_entities as $key => $image_entity) {
+      $this->assertSame(['editor' => ['node' => [1 => '3']]], $file_usage->listUsage($image_entity), 'The image ' . $image_paths[$key] . ' has 3 usages.');
+    }
+
+    // Test hook_entity_update(): decrement, by modifying the last revision:
+    // remove the data-entity-uuid attribute from the body field.
+    foreach ($original_values as $key => $original_value) {
+      $original_value = $node->body[$key]->value;
+      $new_value = str_replace('data-entity-type', 'data-entity-type-modified', $original_value);
+      $node->body[$key]->value = $new_value;
+    }
+    $node->save();
+    foreach ($image_entities as $key => $image_entity) {
+      $this->assertSame(['editor' => ['node' => [1 => '2']]], $file_usage->listUsage($image_entity), 'The image ' . $image_paths[$key] . ' has 2 usages.');
+    }
+
+    // Test hook_entity_update(): increment, by modifying the last revision:
+    // read the data- attributes to the body field.
+    foreach ($original_values as $key => $original_value) {
+      $node->body[$key]->value = $original_value;
+    }
+    $node->save();
+    foreach ($image_entities as $key => $image_entity) {
+      $this->assertSame(['editor' => ['node' => [1 => '3']]], $file_usage->listUsage($image_entity), 'The image ' . $image_paths[$key] . ' has 3 usages.');
+    }
+
+    // Test editor_entity_revision_delete(): decrement, by deleting a revision.
+    $this->container->get('entity_type.manager')->getStorage('node')->deleteRevision($second_revision_id);
+    foreach ($image_entities as $key => $image_entity) {
+      $this->assertSame(['editor' => ['node' => [1 => '2']]], $file_usage->listUsage($image_entity), 'The image ' . $image_paths[$key] . ' has 2 usages.');
+    }
+
+    // Populate both the body and summary. Because this will be the same
+    // revision of the same node, it will record only one usage.
+    foreach ($original_values as $key => $original_value) {
+      $node->body[$key]->value = $original_value;
+      $node->body[$key]->summary = $original_value;
+    }
+    $node->save();
+    foreach ($image_entities as $key => $image_entity) {
+      $this->assertSame(['editor' => ['node' => [1 => '2']]], $file_usage->listUsage($image_entity), 'The image ' . $image_paths[$key] . ' has 2 usages.');
+    }
+
+    // Empty out the body value, but keep the summary. The number of usages
+    // should not change.
+    foreach ($original_values as $key => $original_value) {
+      $node->body[$key]->value = '';
+      $node->body[$key]->summary = $original_value;
+    }
+    $node->save();
+    foreach ($image_entities as $key => $image_entity) {
+      $this->assertSame(['editor' => ['node' => [1 => '2']]], $file_usage->listUsage($image_entity), 'The image ' . $image_paths[$key] . ' has 2 usages.');
+    }
+
+    // Empty out the body and summary. The number of usages should decrease by
+    // one.
+    foreach ($original_values as $key => $original_value) {
+      $node->body[$key]->value = '';
+      $node->body[$key]->summary = '';
+    }
+    $node->save();
+    foreach ($image_entities as $key => $image_entity) {
+      $this->assertSame(['editor' => ['node' => [1 => '1']]], $file_usage->listUsage($image_entity), 'The image ' . $image_paths[$key] . ' has 1 usage.');
+    }
+
+    // Set the field of a custom field type that is a subclass of
+    // Drupal\text\Plugin\Field\FieldType\TextItemBase. The number of usages
+    // should increase by one.
+    foreach ($original_values as $key => $original_value) {
+      $node->description[$key]->value = $original_value;
+    }
+    $node->save();
+    foreach ($image_entities as $key => $image_entity) {
+      $this->assertSame(['editor' => ['node' => [1 => '2']]], $file_usage->listUsage($image_entity), 'The image ' . $image_paths[$key] . ' has 2 usages.');
+    }
+
+    // Test editor_entity_delete().
+    $node->delete();
+    foreach ($image_entities as $key => $image_entity) {
+      $this->assertSame([], $file_usage->listUsage($image_entity), 'The image ' . $image_paths[$key] . ' has zero usages again.');
+    }
+  }
+
+}

web/core/modules/editor/tests/src/Kernel/EditorFilterIntegrationTest.php

@@ -0,0 +1,63 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\Tests\editor\Kernel;
+
+use Drupal\editor\Entity\Editor;
+use Drupal\filter\Entity\FilterFormat;
+use Drupal\KernelTests\KernelTestBase;
+
+/**
+ * Tests integration with filter module.
+ *
+ * @group editor
+ */
+class EditorFilterIntegrationTest extends KernelTestBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $modules = ['filter', 'editor', 'editor_test'];
+
+  /**
+   * Tests text format removal or disabling.
+   */
+  public function testTextFormatIntegration(): void {
+    // Create an arbitrary text format.
+    $format = FilterFormat::create([
+      'format' => $this->randomMachineName(),
+      'name' => $this->randomString(),
+    ]);
+    $format->save();
+
+    // Create a paired editor.
+    Editor::create([
+      'format' => $format->id(),
+      'editor' => 'unicorn',
+      'image_upload' => [
+        'status' => FALSE,
+      ],
+    ])->save();
+
+    // Disable the text format.
+    $format->disable()->save();
+
+    // The paired editor should be disabled too.
+    $this->assertFalse(Editor::load($format->id())->status());
+
+    // Re-enable the text format.
+    $format->enable()->save();
+
+    // The paired editor should be enabled too.
+    $this->assertTrue(Editor::load($format->id())->status());
+
+    // Completely remove the text format. Usually this cannot occur via UI, but
+    // can be triggered from API.
+    $format->delete();
+
+    // The paired editor should be removed.
+    $this->assertNull(Editor::load($format->id()));
+  }
+
+}

web/core/modules/editor/tests/src/Kernel/EditorManagerTest.php

@@ -0,0 +1,117 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\Tests\editor\Kernel;
+
+use Drupal\editor\Entity\Editor;
+use Drupal\filter\Entity\FilterFormat;
+use Drupal\KernelTests\KernelTestBase;
+
+/**
+ * Tests detection of text editors and correct generation of attachments.
+ *
+ * @group editor
+ */
+class EditorManagerTest extends KernelTestBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $modules = ['system', 'user', 'filter', 'editor'];
+
+  /**
+   * The manager for text editor plugins.
+   *
+   * @var \Drupal\Component\Plugin\PluginManagerInterface
+   */
+  protected $editorManager;
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function setUp(): void {
+    parent::setUp();
+
+    // Install the Filter module.
+
+    // Add text formats.
+    $filtered_html_format = FilterFormat::create([
+      'format' => 'filtered_html',
+      'name' => 'Filtered HTML',
+      'weight' => 0,
+      'filters' => [],
+    ]);
+    $filtered_html_format->save();
+    $full_html_format = FilterFormat::create([
+      'format' => 'full_html',
+      'name' => 'Full HTML',
+      'weight' => 1,
+      'filters' => [],
+    ]);
+    $full_html_format->save();
+  }
+
+  /**
+   * Tests the configurable text editor manager.
+   */
+  public function testManager(): void {
+    $this->editorManager = $this->container->get('plugin.manager.editor');
+
+    // Case 1: no text editor available:
+    // - listOptions() should return an empty list of options
+    // - getAttachments() should return an empty #attachments array (and not
+    //   a JS settings structure that is empty)
+    $this->assertSame([], $this->editorManager->listOptions(), 'When no text editor is enabled, the manager works correctly.');
+    $this->assertSame([], $this->editorManager->getAttachments([]), 'No attachments when no text editor is enabled and retrieving attachments for zero text formats.');
+    $this->assertSame([], $this->editorManager->getAttachments(['filtered_html', 'full_html']), 'No attachments when no text editor is enabled and retrieving attachments for multiple text formats.');
+
+    // Enable the Text Editor Test module, which has the Unicorn Editor and
+    // clear the editor manager's cache so it is picked up.
+    $this->enableModules(['editor_test']);
+    $this->editorManager = $this->container->get('plugin.manager.editor');
+    $this->editorManager->clearCachedDefinitions();
+
+    // Case 2: a text editor available.
+    $this->assertSame('Unicorn Editor', (string) $this->editorManager->listOptions()['unicorn'], 'When some text editor is enabled, the manager works correctly.');
+
+    // Case 3: a text editor available & associated (but associated only with
+    // the 'Full HTML' text format).
+    $unicorn_plugin = $this->editorManager->createInstance('unicorn');
+    $editor = Editor::create([
+      'format' => 'full_html',
+      'editor' => 'unicorn',
+      'image_upload' => [
+        'status' => FALSE,
+      ],
+    ]);
+    $editor->save();
+    $this->assertSame([], $this->editorManager->getAttachments([]), 'No attachments when one text editor is enabled and retrieving attachments for zero text formats.');
+    $expected = [
+      'library' => [
+        0 => 'editor_test/unicorn',
+      ],
+      'drupalSettings' => [
+        'editor' => [
+          'formats' => [
+            'full_html' => [
+              'format'  => 'full_html',
+              'editor' => 'unicorn',
+              'editorSettings' => $unicorn_plugin->getJSSettings($editor),
+              'editorSupportsContentFiltering' => TRUE,
+              'isXssSafe' => FALSE,
+            ],
+          ],
+        ],
+      ],
+    ];
+    $this->assertSame($expected, $this->editorManager->getAttachments(['filtered_html', 'full_html']), 'Correct attachments when one text editor is enabled and retrieving attachments for multiple text formats.');
+
+    // Case 4: a text editor available associated, but now with its JS settings
+    // being altered via hook_editor_js_settings_alter().
+    \Drupal::state()->set('editor_test_js_settings_alter_enabled', TRUE);
+    $expected['drupalSettings']['editor']['formats']['full_html']['editorSettings']['ponyModeEnabled'] = FALSE;
+    $this->assertSame($expected, $this->editorManager->getAttachments(['filtered_html', 'full_html']), 'hook_editor_js_settings_alter() works correctly.');
+  }
+
+}

web/core/modules/editor/tests/src/Kernel/EditorValidationTest.php

@@ -0,0 +1,268 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\Tests\editor\Kernel;
+
+use Drupal\ckeditor5\Plugin\CKEditor5Plugin\Heading;
+use Drupal\editor\Entity\Editor;
+use Drupal\filter\Entity\FilterFormat;
+use Drupal\KernelTests\Core\Config\ConfigEntityValidationTestBase;
+
+/**
+ * Tests validation of editor entities.
+ *
+ * @group editor
+ */
+class EditorValidationTest extends ConfigEntityValidationTestBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $modules = ['ckeditor5', 'editor', 'filter'];
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static array $propertiesWithRequiredKeys = [
+    'settings' => [
+      "'toolbar' is a required key because editor is ckeditor5 (see config schema type editor.settings.ckeditor5).",
+      "'plugins' is a required key because editor is ckeditor5 (see config schema type editor.settings.ckeditor5).",
+    ],
+    'image_upload' => "'status' is a required key.",
+  ];
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function setUp(): void {
+    parent::setUp();
+
+    $format = FilterFormat::create([
+      'format' => 'test',
+      'name' => 'Test',
+    ]);
+    $format->save();
+
+    $this->entity = Editor::create([
+      'format' => $format->id(),
+      'editor' => 'ckeditor5',
+      'image_upload' => [
+        'status' => FALSE,
+      ],
+      'settings' => [
+        // @see \Drupal\ckeditor5\Plugin\Editor\CKEditor5::getDefaultSettings()
+        'toolbar' => [
+          'items' => ['heading', 'bold', 'italic'],
+        ],
+        'plugins' => [
+          'ckeditor5_heading' => Heading::DEFAULT_CONFIGURATION,
+        ],
+      ],
+    ]);
+    $this->entity->save();
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function testImmutableProperties(array $valid_values = [], ?array $additional_expected_validation_errors_when_missing = NULL): void {
+    // TRICKY: Every Text Editor is associated with a Text Format. It must exist
+    // to avoid triggering a validation error.
+    // @see \Drupal\editor\EditorInterface::hasAssociatedFilterFormat
+    FilterFormat::create([
+      'format' => 'another',
+      'name' => 'Another',
+    ])->save();
+    parent::testImmutableProperties(['format' => 'another']);
+  }
+
+  /**
+   * Tests that validation fails if config dependencies are invalid.
+   */
+  public function testInvalidDependencies(): void {
+    // Remove the config dependencies from the editor entity.
+    $dependencies = $this->entity->getDependencies();
+    $dependencies['config'] = [];
+    $this->entity->set('dependencies', $dependencies);
+
+    $this->assertValidationErrors(['' => 'This text editor requires a text format.']);
+
+    // Things look sort-of like `filter.format.*` should fail validation
+    // because they don't exist.
+    $dependencies['config'] = [
+      'filter.format',
+      'filter.format.',
+    ];
+    $this->entity->set('dependencies', $dependencies);
+    $this->assertValidationErrors([
+      '' => 'This text editor requires a text format.',
+      'dependencies.config.0' => "The 'filter.format' config does not exist.",
+      'dependencies.config.1' => "The 'filter.format.' config does not exist.",
+    ]);
+  }
+
+  /**
+   * Tests validating an editor with an unknown plugin ID.
+   */
+  public function testInvalidPluginId(): void {
+    $this->entity->setEditor('non_existent');
+    $this->assertValidationErrors(['editor' => "The 'non_existent' plugin does not exist."]);
+  }
+
+  /**
+   * Tests validating an editor with a non-existent `format`.
+   */
+  public function testInvalidFormat(): void {
+    $this->entity->set('format', 'non_existent');
+    $this->assertValidationErrors([
+      '' => "The 'format' property cannot be changed.",
+      'format' => "The 'filter.format.non_existent' config does not exist.",
+    ]);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function testLabelValidation(): void {
+    // @todo Remove this override in https://www.drupal.org/i/3231354. The label of Editor entities is dynamically computed: it's retrieved from the associated FilterFormat entity. That issue will change this.
+    // @see \Drupal\editor\Entity\Editor::label()
+    $this->markTestSkipped();
+  }
+
+  /**
+   * Test validation when dynamically changing image upload settings.
+   *
+   * Additional keys are required when image_upload.status is TRUE.
+   */
+  public function testImageUploadSettingsAreDynamicallyRequired(): void {
+    // When image uploads are disabled, no other key-value pairs are needed.
+    $this->entity->setImageUploadSettings(['status' => FALSE]);
+    $this->assertValidationErrors([]);
+
+    // But when they are enabled, many others are needed.
+    $this->entity->setImageUploadSettings(['status' => TRUE]);
+    $this->assertValidationErrors([
+      'image_upload' => [
+        "'scheme' is a required key because image_upload.status is 1 (see config schema type editor.image_upload_settings.1).",
+        "'directory' is a required key because image_upload.status is 1 (see config schema type editor.image_upload_settings.1).",
+        "'max_size' is a required key because image_upload.status is 1 (see config schema type editor.image_upload_settings.1).",
+        "'max_dimensions' is a required key because image_upload.status is 1 (see config schema type editor.image_upload_settings.1).",
+      ],
+    ]);
+
+    // Specify all required keys, but forget one.
+    $this->entity->setImageUploadSettings([
+      'status' => TRUE,
+      'scheme' => 'public',
+      'directory' => 'uploaded-images',
+      'max_size' => '5 MB',
+    ]);
+    $this->assertValidationErrors(['image_upload' => "'max_dimensions' is a required key because image_upload.status is 1 (see config schema type editor.image_upload_settings.1)."]);
+
+    // Specify all required keys.
+    $this->entity->setImageUploadSettings([
+      'status' => TRUE,
+      'scheme' => 'public',
+      'directory' => 'uploaded-images',
+      'max_size' => '5 MB',
+      'max_dimensions' => [
+        'width' => 10000,
+        'height' => 10000,
+      ],
+    ]);
+    $this->assertValidationErrors([]);
+
+    // Specify all required keys … but now disable image uploads again. This
+    // should trigger a validation error from the ValidKeys constraint.
+    $this->entity->setImageUploadSettings([
+      'status' => FALSE,
+      'scheme' => 'public',
+      'directory' => 'uploaded-images',
+      'max_size' => '5 MB',
+      'max_dimensions' => [
+        'width' => 10000,
+        'height' => 10000,
+      ],
+    ]);
+    $this->assertValidationErrors([
+      'image_upload' => [
+        "'scheme' is an unknown key because image_upload.status is 0 (see config schema type editor.image_upload_settings.*).",
+        "'directory' is an unknown key because image_upload.status is 0 (see config schema type editor.image_upload_settings.*).",
+        "'max_size' is an unknown key because image_upload.status is 0 (see config schema type editor.image_upload_settings.*).",
+        "'max_dimensions' is an unknown key because image_upload.status is 0 (see config schema type editor.image_upload_settings.*).",
+      ],
+    ]);
+
+    // Remove the values that the messages said are unknown.
+    $this->entity->setImageUploadSettings(['status' => FALSE]);
+    $this->assertValidationErrors([]);
+
+    // Note how this is the same as the initial value. This proves that `status`
+    // being FALSE prevents any meaningless key-value pairs to be present, and
+    // `status` being TRUE requires those then meaningful pairs to be present.
+  }
+
+  /**
+   * @testWith [{"scheme": "public"}, {}]
+   *           [{"scheme": "private"}, {"image_upload.scheme": "The file storage you selected is not a visible, readable and writable stream wrapper. Possible choices: <em class=\"placeholder\">&quot;public&quot;</em>."}]
+   *           [{"directory": null}, {}]
+   *           [{"directory": ""}, {"image_upload.directory": "This value should not be blank."}]
+   *           [{"directory": "inline\nimages"}, {"image_upload.directory": "The image upload directory is not allowed to span multiple lines or contain control characters."}]
+   *           [{"directory": "foo\b\b\binline-images"}, {"image_upload.directory": "The image upload directory is not allowed to span multiple lines or contain control characters."}]
+   *           [{"max_size": null}, {}]
+   *           [{"max_size": "foo"}, {"image_upload.max_size": "This value must be a number of bytes, optionally with a unit such as \"MB\" or \"megabytes\". <em class=\"placeholder\">foo</em> does not represent a number of bytes."}]
+   *           [{"max_size": ""}, {"image_upload.max_size": "This value must be a number of bytes, optionally with a unit such as \"MB\" or \"megabytes\". <em class=\"placeholder\"></em> does not represent a number of bytes."}]
+   *           [{"max_size": "7 exabytes"}, {}]
+   *           [{"max_dimensions": {"width": null, "height": 15}}, {}]
+   *           [{"max_dimensions": {"width": null, "height": null}}, {}]
+   *           [{"max_dimensions": {"width": null, "height": 0}}, {"image_upload.max_dimensions.height": "This value should be between <em class=\"placeholder\">1</em> and <em class=\"placeholder\">99999</em>."}]
+   *           [{"max_dimensions": {"width": 100000, "height": 1}}, {"image_upload.max_dimensions.width": "This value should be between <em class=\"placeholder\">1</em> and <em class=\"placeholder\">99999</em>."}]
+   */
+  public function testImageUploadSettingsValidation(array $invalid_setting, array $expected_message): void {
+    $this->entity->setImageUploadSettings($invalid_setting + [
+      'status' => TRUE,
+      'scheme' => 'public',
+      'directory' => 'uploaded-images',
+      'max_size' => '5 MB',
+      'max_dimensions' => [
+        'width' => 10000,
+        'height' => 10000,
+      ],
+    ]);
+    $this->assertValidationErrors($expected_message);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function testRequiredPropertyValuesMissing(?array $additional_expected_validation_errors_when_missing = NULL): void {
+    parent::testRequiredPropertyValuesMissing([
+      'dependencies' => [
+        // @see ::testInvalidDependencies()
+        // @see \Drupal\Core\Config\Plugin\Validation\Constraint\RequiredConfigDependenciesConstraintValidator
+        '' => 'This text editor requires a text format.',
+      ],
+      'settings' => [
+        'settings.plugins.ckeditor5_heading' => 'Configuration for the enabled plugin "<em class="placeholder">Headings</em>" (<em class="placeholder">ckeditor5_heading</em>) is missing.',
+      ],
+    ]);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function testRequiredPropertyKeysMissing(?array $additional_expected_validation_errors_when_missing = NULL): void {
+    parent::testRequiredPropertyKeysMissing([
+      'dependencies' => [
+        // @see ::testInvalidDependencies()
+        // @see \Drupal\Core\Config\Plugin\Validation\Constraint\RequiredConfigDependenciesConstraintValidator
+        '' => 'This text editor requires a text format.',
+      ],
+      'settings' => [
+        'settings.plugins.ckeditor5_heading' => 'Configuration for the enabled plugin "<em class="placeholder">Headings</em>" (<em class="placeholder">ckeditor5_heading</em>) is missing.',
+      ],
+    ]);
+  }
+
+}

web/core/modules/editor/tests/src/Kernel/EntityUpdateTest.php

@@ -0,0 +1,68 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\Tests\editor\Kernel;
+
+use Drupal\KernelTests\Core\Entity\EntityKernelTestBase;
+use Drupal\node\Entity\NodeType;
+use Drupal\node\Entity\Node;
+
+/**
+ * Tests updating an entity.
+ *
+ * @group editor
+ */
+class EntityUpdateTest extends EntityKernelTestBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $modules = ['editor', 'editor_test', 'node'];
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function setUp(): void {
+    parent::setUp();
+    $this->installSchema('node', ['node_access']);
+    $this->installConfig(['node']);
+
+    // Create a node type for testing.
+    $type = NodeType::create(['type' => 'page', 'name' => 'page']);
+    $type->save();
+
+    // Set editor_test module weight to be lower than editor module's weight so
+    // that editor_test_entity_update() is called before editor_entity_update().
+    $extension_config = \Drupal::configFactory()->get('core.extension');
+    $editor_module_weight = $extension_config->get('module.editor');
+    module_set_weight('editor_test', $editor_module_weight - 1);
+  }
+
+  /**
+   * Tests updating an existing entity.
+   *
+   * @see editor_test_entity_update()
+   */
+  public function testEntityUpdate(): void {
+    // Create a node.
+    $node = Node::create([
+      'type' => 'page',
+      'title' => 'test',
+    ]);
+    $node->save();
+
+    // Update the node.
+    // What happens is the following:
+    // 1. \Drupal\Core\Entity\EntityStorageBase::doPostSave() gets called.
+    // 2. editor_test_entity_update() gets called.
+    // 3. A resave of the updated entity gets triggered (second save call).
+    // 4. \Drupal\Core\Entity\EntityStorageBase::doPostSave() gets called.
+    // 5. editor_test_entity_update() gets called.
+    // 6. editor_entity_update() gets called (caused by the second save call).
+    // 7. editor_entity_update() gets called (caused by the first save call).
+    $node->title->value = 'test updated';
+    $node->save();
+  }
+
+}

web/core/modules/editor/tests/src/Unit/EditorConfigEntityUnitTest.php

@@ -0,0 +1,138 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\Tests\editor\Unit;
+
+use Drupal\Core\DependencyInjection\ContainerBuilder;
+use Drupal\Core\Entity\EntityTypeManagerInterface;
+use Drupal\editor\Entity\Editor;
+use Drupal\Tests\UnitTestCase;
+
+/**
+ * @coversDefaultClass \Drupal\editor\Entity\Editor
+ * @group editor
+ */
+class EditorConfigEntityUnitTest extends UnitTestCase {
+
+  /**
+   * The entity type used for testing.
+   *
+   * @var \Drupal\Core\Entity\EntityTypeInterface|\PHPUnit\Framework\MockObject\MockObject
+   */
+  protected $entityType;
+
+  /**
+   * The entity type manager used for testing.
+   *
+   * @var \Drupal\Core\Entity\EntityTypeManagerInterface|\PHPUnit\Framework\MockObject\MockObject
+   */
+  protected $entityTypeManager;
+
+  /**
+   * The ID of the type of the entity under test.
+   *
+   * @var string
+   */
+  protected $entityTypeId;
+
+  /**
+   * The UUID generator used for testing.
+   *
+   * @var \Drupal\Component\Uuid\UuidInterface|\PHPUnit\Framework\MockObject\MockObject
+   */
+  protected $uuid;
+
+  /**
+   * The editor plugin manager used for testing.
+   *
+   * @var \Drupal\editor\Plugin\EditorManager|\PHPUnit\Framework\MockObject\MockObject
+   */
+  protected $editorPluginManager;
+
+  /**
+   * Editor plugin ID.
+   *
+   * @var string
+   */
+  protected $editorId;
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function setUp(): void {
+    parent::setUp();
+
+    $this->editorId = $this->randomMachineName();
+    $this->entityTypeId = $this->randomMachineName();
+
+    $this->entityType = $this->createMock('\Drupal\Core\Entity\EntityTypeInterface');
+    $this->entityType->expects($this->any())
+      ->method('getProvider')
+      ->willReturn('editor');
+
+    $this->entityTypeManager = $this->createMock(EntityTypeManagerInterface::class);
+    $this->entityTypeManager->expects($this->any())
+      ->method('getDefinition')
+      ->with($this->entityTypeId)
+      ->willReturn($this->entityType);
+
+    $this->uuid = $this->createMock('\Drupal\Component\Uuid\UuidInterface');
+
+    $this->editorPluginManager = $this->getMockBuilder('Drupal\editor\Plugin\EditorManager')
+      ->disableOriginalConstructor()
+      ->getMock();
+
+    $container = new ContainerBuilder();
+    $container->set('entity_type.manager', $this->entityTypeManager);
+    $container->set('uuid', $this->uuid);
+    $container->set('plugin.manager.editor', $this->editorPluginManager);
+    \Drupal::setContainer($container);
+  }
+
+  /**
+   * @covers ::calculateDependencies
+   */
+  public function testCalculateDependencies(): void {
+    $format_id = 'filter.format.test';
+    $values = ['editor' => $this->editorId, 'format' => $format_id];
+
+    $plugin = $this->getMockBuilder('Drupal\editor\Plugin\EditorPluginInterface')
+      ->disableOriginalConstructor()
+      ->getMock();
+    $plugin->expects($this->once())
+      ->method('getPluginDefinition')
+      ->willReturn(['provider' => 'test_module']);
+    $plugin->expects($this->once())
+      ->method('getDefaultSettings')
+      ->willReturn([]);
+
+    $this->editorPluginManager->expects($this->any())
+      ->method('createInstance')
+      ->with($this->editorId)
+      ->willReturn($plugin);
+
+    $entity = new Editor($values, $this->entityTypeId);
+
+    $filter_format = $this->createMock('Drupal\Core\Config\Entity\ConfigEntityInterface');
+    $filter_format->expects($this->once())
+      ->method('getConfigDependencyName')
+      ->willReturn('filter.format.test');
+
+    $storage = $this->createMock('Drupal\Core\Entity\EntityStorageInterface');
+    $storage->expects($this->once())
+      ->method('load')
+      ->with($format_id)
+      ->willReturn($filter_format);
+
+    $this->entityTypeManager->expects($this->once())
+      ->method('getStorage')
+      ->with('filter_format')
+      ->willReturn($storage);
+
+    $dependencies = $entity->calculateDependencies()->getDependencies();
+    $this->assertContains('test_module', $dependencies['module']);
+    $this->assertContains('filter.format.test', $dependencies['config']);
+  }
+
+}

web/core/modules/editor/tests/src/Unit/EditorXssFilter/StandardTest.php

@@ -0,0 +1,796 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\Tests\editor\Unit\EditorXssFilter;
+
+use Drupal\editor\EditorXssFilter\Standard;
+use Drupal\filter\Plugin\FilterInterface;
+use Drupal\Tests\UnitTestCase;
+
+// cspell:ignore ascript attributename bgsound bscript ckers cript datafld
+// cspell:ignore dataformatas datasrc dynsrc ession livescript msgbox nmouseover
+// cspell:ignore noxss pression ript scri scriptlet unicoded vbscript
+
+/**
+ * @coversDefaultClass \Drupal\editor\EditorXssFilter\Standard
+ * @group editor
+ */
+class StandardTest extends UnitTestCase {
+
+  /**
+   * The mocked text format configuration entity.
+   *
+   * @var \Drupal\filter\Entity\FilterFormat|\PHPUnit\Framework\MockObject\MockObject
+   */
+  protected $format;
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function setUp(): void {
+    parent::setUp();
+
+    // Mock text format configuration entity object.
+    $this->format = $this->getMockBuilder('\Drupal\filter\Entity\FilterFormat')
+      ->disableOriginalConstructor()
+      ->getMock();
+    $this->format->expects($this->any())
+      ->method('getFilterTypes')
+      ->willReturn([FilterInterface::TYPE_HTML_RESTRICTOR]);
+    $restrictions = [
+      'allowed' => [
+        'p' => TRUE,
+        'a' => TRUE,
+        '*' => [
+          'style' => FALSE,
+          'on*' => FALSE,
+        ],
+      ],
+    ];
+    $this->format->expects($this->any())
+      ->method('getHtmlRestrictions')
+      ->willReturn($restrictions);
+  }
+
+  /**
+   * Provides test data for testFilterXss().
+   *
+   * @see \Drupal\Tests\editor\Unit\editor\EditorXssFilter\StandardTest::testFilterXss()
+   */
+  public static function providerTestFilterXss() {
+    $data = [];
+    $data[] = [
+      '<p>Hello, world!</p><unknown>Pink Fairy Armadillo</unknown>',
+      '<p>Hello, world!</p><unknown>Pink Fairy Armadillo</unknown>',
+    ];
+    $data[] = [
+      '<p style="color:red">Hello, world!</p><unknown>Pink Fairy Armadillo</unknown>',
+      '<p>Hello, world!</p><unknown>Pink Fairy Armadillo</unknown>',
+    ];
+    $data[] = [
+      '<p>Hello, world!</p><unknown>Pink Fairy Armadillo</unknown><script>alert("evil");</script>',
+      '<p>Hello, world!</p><unknown>Pink Fairy Armadillo</unknown>alert("evil");',
+    ];
+    $data[] = [
+      '<p>Hello, world!</p><unknown>Pink Fairy Armadillo</unknown><a href="javascript:alert(1)">test</a>',
+      '<p>Hello, world!</p><unknown>Pink Fairy Armadillo</unknown><a href="alert(1)">test</a>',
+    ];
+
+    // All cases listed on
+    // https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
+
+    // No Filter Evasion.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#No_Filter_Evasion
+    $data[] = ['<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>', ''];
+
+    // Image XSS using the JavaScript directive.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Image_XSS_using_the_JavaScript_directive
+    $data[] = [
+      '<IMG SRC="javascript:alert(\'XSS\');">',
+      '<IMG src="alert(&#039;XSS&#039;);">',
+    ];
+
+    // No quotes and no semicolon.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#No_quotes_and_no_semicolon
+    $data[] = ['<IMG SRC=javascript:alert(\'XSS\')>', '<IMG>'];
+
+    // Case insensitive XSS attack vector.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Case_insensitive_XSS_attack_vector
+    $data[] = ['<IMG SRC=JaVaScRiPt:alert(\'XSS\')>', '<IMG>'];
+
+    // HTML entities.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#HTML_entities
+    $data[] = ['<IMG SRC=javascript:alert("XSS")>', '<IMG>'];
+
+    // Grave accent obfuscation.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Grave_accent_obfuscation
+    $data[] = ['<IMG SRC=`javascript:alert("RSnake says, \'XSS\'")`>', '<IMG>'];
+
+    // Malformed A tags.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Malformed_A_tags
+    $data[] = [
+      '<a onmouseover="alert(document.cookie)">xxs link</a>',
+      '<a>xxs link</a>',
+    ];
+    $data[] = [
+      '<a onmouseover=alert(document.cookie)>xxs link</a>',
+      '<a>xxs link</a>',
+    ];
+
+    // Malformed IMG tags.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Malformed_IMG_tags
+    $data[] = [
+      '<IMG """><SCRIPT>alert("XSS")</SCRIPT>">',
+      '<IMG>alert("XSS")"&gt;',
+    ];
+
+    // fromCharCode.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#fromCharCode
+    $data[] = [
+      '<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>',
+      '<IMG src="alert(String.fromCharCode(88,83,83))">',
+    ];
+
+    // Default SRC tag to get past filters that check SRC domain.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Default_SRC_tag_to_get_past_filters_that_check_SRC_domain
+    $data[] = ['<IMG SRC=# onmouseover="alert(\'xxs\')">', '<IMG src="#">'];
+
+    // Default SRC tag by leaving it empty.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Default_SRC_tag_by_leaving_it_empty
+    $data[] = ['<IMG SRC= onmouseover="alert(\'xxs\')">', '<IMG>'];
+
+    // Default SRC tag by leaving it out entirely.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Default_SRC_tag_by_leaving_it_out_entirely
+    $data[] = ['<IMG onmouseover="alert(\'xxs\')">', '<IMG>'];
+
+    // Decimal HTML character references.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Decimal_HTML_character_references
+    $data[] = [
+      '<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>',
+      '<IMG src="alert(&#039;XSS&#039;)">',
+    ];
+
+    // Decimal HTML character references without trailing semicolons.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Decimal_HTML_character_references_without_trailing_semicolons
+    $data[] = [
+      '<IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>',
+      '<IMG src="&amp;#0000106&amp;#0000097&amp;#0000118&amp;#0000097&amp;#0000115&amp;#0000099&amp;#0000114&amp;#0000105&amp;#0000112&amp;#0000116&amp;#0000058&amp;#0000097&amp;#0000108&amp;#0000101&amp;#0000114&amp;#0000116&amp;#0000040&amp;#0000039&amp;#0000088&amp;#0000083&amp;#0000083&amp;#0000039&amp;#0000041">',
+    ];
+
+    // Hexadecimal HTML character references without trailing semicolons.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Hexadecimal_HTML_character_references_without_trailing_semicolons
+    $data[] = [
+      '<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>',
+      '<IMG src="&amp;#x6A&amp;#x61&amp;#x76&amp;#x61&amp;#x73&amp;#x63&amp;#x72&amp;#x69&amp;#x70&amp;#x74&amp;#x3A&amp;#x61&amp;#x6C&amp;#x65&amp;#x72&amp;#x74&amp;#x28&amp;#x27&amp;#x58&amp;#x53&amp;#x53&amp;#x27&amp;#x29">',
+    ];
+
+    // Embedded tab.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Embedded_tab
+    $data[] = [
+      '<IMG SRC="jav  ascript:alert(\'XSS\');">',
+      '<IMG src="alert(&#039;XSS&#039;);">',
+    ];
+
+    // Embedded Encoded tab.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Embedded_Encoded_tab
+    $data[] = [
+      '<IMG SRC="jav&#x09;ascript:alert(\'XSS\');">',
+      '<IMG src="alert(&#039;XSS&#039;);">',
+    ];
+
+    // Embedded newline to break up XSS.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Embedded_newline_to_break_up_XSS
+    $data[] = [
+      '<IMG SRC="jav&#x0A;ascript:alert(\'XSS\');">',
+      '<IMG src="alert(&#039;XSS&#039;);">',
+    ];
+
+    // Embedded carriage return to break up XSS.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Embedded_carriage_return_to_break_up_XSS
+    $data[] = [
+      '<IMG SRC="jav&#x0D;ascript:alert(\'XSS\');">',
+      '<IMG src="alert(&#039;XSS&#039;);">',
+    ];
+
+    // Null breaks up JavaScript directive.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Null_breaks_up_JavaScript_directive
+    $data[] = ["<IMG SRC=java\0script:alert(\"XSS\")>", '<IMG>'];
+
+    // Non-alpha-non-digit XSS.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Non-alpha-non-digit_XSS
+    $data[] = ['<SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT>', ''];
+    $data[] = ['<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")>', '<BODY>'];
+    $data[] = ['<SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT>', ''];
+
+    // Extraneous open brackets.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Extraneous_open_brackets
+    $data[] = ['<<SCRIPT>alert("XSS");//<</SCRIPT>', '&lt;alert("XSS");//&lt;'];
+
+    // No closing script tags.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#No_closing_script_tags
+    $data[] = ['<SCRIPT SRC=http://ha.ckers.org/xss.js?< B >', ''];
+
+    // Protocol resolution in script tags.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Protocol_resolution_in_script_tags
+    $data[] = ['<SCRIPT SRC=//ha.ckers.org/.j>', ''];
+
+    // Half open HTML/JavaScript XSS vector.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Half_open_HTML.2FJavaScript_XSS_vector
+    $data[] = [
+      '<IMG SRC="javascript:alert(\'XSS\')"',
+      '<IMG src="alert(&#039;XSS&#039;)">',
+    ];
+
+    // Double open angle brackets.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Double_open_angle_brackets
+    // @see http://ha.ckers.org/blog/20060611/hotbot-xss-vulnerability/ to
+    // understand why this is a vulnerability.
+    $data[] = ['<iframe src=http://ha.ckers.org/scriptlet.html <', '<iframe src="http://ha.ckers.org/scriptlet.html">'];
+
+    // Escaping JavaScript escapes.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Escaping_JavaScript_escapes
+    // This one is irrelevant for Drupal; we *never* output any JavaScript code
+    // that depends on the URL's query string.
+
+    // End title tag.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#End_title_tag
+    $data[] = [
+      '</TITLE><SCRIPT>alert("XSS");</SCRIPT>',
+      '</TITLE>alert("XSS");',
+    ];
+
+    // INPUT image.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#INPUT_image
+    $data[] = [
+      '<INPUT TYPE="IMAGE" SRC="javascript:alert(\'XSS\');">',
+      '<INPUT type="IMAGE" src="alert(&#039;XSS&#039;);">',
+    ];
+
+    // BODY image.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#BODY_image
+    $data[] = [
+      '<BODY BACKGROUND="javascript:alert(\'XSS\')">',
+      '<BODY background="alert(&#039;XSS&#039;)">',
+    ];
+
+    // IMG Dynsrc.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#IMG_Dynsrc
+    $data[] = [
+      '<IMG DYNSRC="javascript:alert(\'XSS\')">',
+      '<IMG dynsrc="alert(&#039;XSS&#039;)">',
+    ];
+
+    // IMG lowsrc.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#IMG_lowsrc
+    $data[] = [
+      '<IMG LOWSRC="javascript:alert(\'XSS\')">',
+      '<IMG lowsrc="alert(&#039;XSS&#039;)">',
+    ];
+
+    // List-style-image.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#List-style-image
+    $data[] = [
+      '<STYLE>li {list-style-image: url("javascript:alert(\'XSS\')");}</STYLE><UL><LI>XSS</br>',
+      'li {list-style-image: url("javascript:alert(\'XSS\')");}<UL><LI>XSS</br>',
+    ];
+
+    // VBscript in an image.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#VBscript_in_an_image
+    $data[] = [
+      '<IMG SRC=\'vbscript:msgbox("XSS")\'>',
+      '<IMG src=\'msgbox(&quot;XSS&quot;)\'>',
+    ];
+
+    // Livescript (older versions of Netscape only).
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Livescript_.28older_versions_of_Netscape_only.29
+    $data[] = ['<IMG SRC="livescript:[code]">', '<IMG src="[code]">'];
+
+    // BODY tag.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#BODY_tag
+    $data[] = ['<BODY ONLOAD=alert(\'XSS\')>', '<BODY>'];
+
+    // Event handlers.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Event_Handlers
+    $events = [
+      'onAbort',
+      'onActivate',
+      'onAfterPrint',
+      'onAfterUpdate',
+      'onBeforeActivate',
+      'onBeforeCopy',
+      'onBeforeCut',
+      'onBeforeDeactivate',
+      'onBeforeEditFocus',
+      'onBeforePaste',
+      'onBeforePrint',
+      'onBeforeUnload',
+      'onBeforeUpdate',
+      'onBegin',
+      'onBlur',
+      'onBounce',
+      'onCellChange',
+      'onChange',
+      'onClick',
+      'onContextMenu',
+      'onControlSelect',
+      'onCopy',
+      'onCut',
+      'onDataAvailable',
+      'onDataSetChanged',
+      'onDataSetComplete',
+      'onDblClick',
+      'onDeactivate',
+      'onDrag',
+      'onDragEnd',
+      'onDragLeave',
+      'onDragEnter',
+      'onDragOver',
+      'onDragDrop',
+      'onDragStart',
+      'onDrop',
+      'onEnd',
+      'onError',
+      'onErrorUpdate',
+      'onFilterChange',
+      'onFinish',
+      'onFocus',
+      'onFocusIn',
+      'onFocusOut',
+      'onHashChange',
+      'onHelp',
+      'onInput',
+      'onKeyDown',
+      'onKeyPress',
+      'onKeyUp',
+      'onLayoutComplete',
+      'onLoad',
+      'onLoseCapture',
+      'onMediaComplete',
+      'onMediaError',
+      'onMessage',
+      'onMousedown',
+      'onMouseEnter',
+      'onMouseLeave',
+      'onMouseMove',
+      'onMouseOut',
+      'onMouseOver',
+      'onMouseUp',
+      'onMouseWheel',
+      'onMove',
+      'onMoveEnd',
+      'onMoveStart',
+      'onOffline',
+      'onOnline',
+      'onOutOfSync',
+      'onPaste',
+      'onPause',
+      'onPopState',
+      'onProgress',
+      'onPropertyChange',
+      'onReadyStateChange',
+      'onRedo',
+      'onRepeat',
+      'onReset',
+      'onResize',
+      'onResizeEnd',
+      'onResizeStart',
+      'onResume',
+      'onReverse',
+      'onRowsEnter',
+      'onRowExit',
+      'onRowDelete',
+      'onRowInserted',
+      'onScroll',
+      'onSeek',
+      'onSelect',
+      'onSelectionChange',
+      'onSelectStart',
+      'onStart',
+      'onStop',
+      'onStorage',
+      'onSyncRestored',
+      'onSubmit',
+      'onTimeError',
+      'onTrackChange',
+      'onUndo',
+      'onUnload',
+      'onURLFlip',
+    ];
+    foreach ($events as $event) {
+      $data[] = ['<p ' . $event . '="javascript:alert(\'XSS\');">Dangerous llama!</p>', '<p>Dangerous llama!</p>'];
+    }
+
+    // BGSOUND.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#BGSOUND
+    $data[] = [
+      '<BGSOUND SRC="javascript:alert(\'XSS\');">',
+      '<BGSOUND src="alert(&#039;XSS&#039;);">',
+    ];
+
+    // & JavaScript includes.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#.26_JavaScript_includes
+    $data[] = ['<BR SIZE="&{alert(\'XSS\')}">', '<BR size="">'];
+
+    // STYLE sheet.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#STYLE_sheet
+    $data[] = ['<LINK REL="stylesheet" HREF="javascript:alert(\'XSS\');">', ''];
+
+    // Remote style sheet.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Remote_style_sheet
+    $data[] = [
+      '<LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css">',
+      '',
+    ];
+
+    // Remote style sheet part 2.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Remote_style_sheet_part_2
+    $data[] = [
+      '<STYLE>@import\'http://ha.ckers.org/xss.css\';</STYLE>',
+      '@import\'http://ha.ckers.org/xss.css\';',
+    ];
+
+    // Remote style sheet part 3.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Remote_style_sheet_part_3
+    $data[] = [
+      '<META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet">',
+      '<META http-equiv="Link">; REL=stylesheet"&gt;',
+    ];
+
+    // Remote style sheet part 4.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Remote_style_sheet_part_4
+    $data[] = [
+      '<STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE>',
+      'BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}',
+    ];
+
+    // STYLE tags with broken up JavaScript for XSS.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#STYLE_tags_with_broken_up_JavaScript_for_XSS
+    $data[] = [
+      '<STYLE>@im\port\'\ja\vasc\ript:alert("XSS")\';</STYLE>',
+      '@im\port\'\ja\vasc\ript:alert("XSS")\';',
+    ];
+
+    // STYLE attribute using a comment to break up expression.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#STYLE_attribute_using_a_comment_to_break_up_expression
+    $data[] = ['<IMG STYLE="xss:expr/*XSS*/ession(alert(\'XSS\'))">', '<IMG>'];
+
+    // IMG STYLE with expression.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#IMG_STYLE_with_expression
+    $data[] = [
+      'exp/*<A STYLE=\'no\xss:noxss("*//*");
+xss:ex/*XSS*//*/*/pression(alert("XSS"))\'>',
+      'exp/*<A>',
+    ];
+
+    // STYLE tag (Older versions of Netscape only).
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#STYLE_tag_.28Older_versions_of_Netscape_only.29
+    $data[] = [
+      '<STYLE TYPE="text/javascript">alert(\'XSS\');</STYLE>',
+      'alert(\'XSS\');',
+    ];
+
+    // STYLE tag using background-image.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#STYLE_tag_using_background-image
+    $data[] = [
+      '<STYLE>.XSS{background-image:url("javascript:alert(\'XSS\')");}</STYLE><A CLASS=XSS></A>',
+      '.XSS{background-image:url("javascript:alert(\'XSS\')");}<A class="XSS"></A>',
+    ];
+
+    // STYLE tag using background.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#STYLE_tag_using_background
+    $data[] = [
+      '<STYLE type="text/css">BODY{background:url("javascript:alert(\'XSS\')")}</STYLE>',
+      'BODY{background:url("javascript:alert(\'XSS\')")}',
+    ];
+
+    // Anonymous HTML with STYLE attribute.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Anonymous_HTML_with_STYLE_attribute
+    $data[] = ['<XSS STYLE="xss:expression(alert(\'XSS\'))">', '<XSS>'];
+
+    // Local htc file.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Local_htc_file
+    $data[] = ['<XSS STYLE="behavior: url(xss.htc);">', '<XSS>'];
+
+    // US-ASCII encoding.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#US-ASCII_encoding
+    // This one is irrelevant for Drupal; Drupal *always* outputs UTF-8.
+
+    // META.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#META
+    $data[] = [
+      '<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert(\'XSS\');">',
+      '<META http-equiv="refresh" content="alert(&#039;XSS&#039;);">',
+    ];
+
+    // META using data.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#META_using_data
+    $data[] = [
+      '<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">',
+      '<META http-equiv="refresh" content="text/html base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">',
+    ];
+
+    // META with additional URL parameter
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#META
+    $data[] = [
+      '<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert(\'XSS\');">',
+      '<META http-equiv="refresh" content="//;URL=javascript:alert(&#039;XSS&#039;);">',
+    ];
+
+    // IFRAME.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#IFRAME
+    $data[] = [
+      '<IFRAME SRC="javascript:alert(\'XSS\');"></IFRAME>',
+      '<IFRAME src="alert(&#039;XSS&#039;);"></IFRAME>',
+    ];
+
+    // IFRAME Event based.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#IFRAME_Event_based
+    $data[] = [
+      '<IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>',
+      '<IFRAME src="#"></IFRAME>',
+    ];
+
+    // FRAME.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#FRAME
+    $data[] = [
+      '<FRAMESET><FRAME SRC="javascript:alert(\'XSS\');"></FRAMESET>',
+      '<FRAMESET><FRAME src="alert(&#039;XSS&#039;);"></FRAMESET>',
+    ];
+
+    // TABLE.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#TABLE
+    $data[] = [
+      '<TABLE BACKGROUND="javascript:alert(\'XSS\')">',
+      '<TABLE background="alert(&#039;XSS&#039;)">',
+    ];
+
+    // TD.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#TD
+    $data[] = [
+      '<TABLE><TD BACKGROUND="javascript:alert(\'XSS\')">',
+      '<TABLE><TD background="alert(&#039;XSS&#039;)">',
+    ];
+
+    // DIV background-image.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#DIV_background-image
+    $data[] = [
+      '<DIV STYLE="background-image: url(javascript:alert(\'XSS\'))">',
+      '<DIV>',
+    ];
+
+    // DIV background-image with unicoded XSS exploit.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#DIV_background-image_with_unicoded_XSS_exploit
+    $data[] = [
+      '<DIV STYLE="background-image:\0075\0072\006C\0028\'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029\'\0029">',
+      '<DIV>',
+    ];
+
+    // DIV background-image plus extra characters.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#DIV_background-image_plus_extra_characters
+    $data[] = [
+      '<DIV STYLE="background-image: url(&#1;javascript:alert(\'XSS\'))">',
+      '<DIV>',
+    ];
+
+    // DIV expression.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#DIV_expression
+    $data[] = ['<DIV STYLE="width: expression(alert(\'XSS\'));">', '<DIV>'];
+
+    // Downlevel-Hidden block.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Downlevel-Hidden_block
+    $data[] = [
+      '<!--[if gte IE 4]>
+ <SCRIPT>alert(\'XSS\');</SCRIPT>
+ <![endif]-->',
+      "\n alert('XSS');\n ",
+    ];
+
+    // BASE tag.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#BASE_tag
+    $data[] = [
+      '<BASE HREF="javascript:alert(\'XSS\');//">',
+      '<BASE href="alert(&#039;XSS&#039;);//">',
+    ];
+
+    // OBJECT tag.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#OBJECT_tag
+    $data[] = [
+      '<OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT>',
+      '',
+    ];
+
+    // Using an EMBED tag you can embed a Flash movie that contains XSS.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Using_an_EMBED_tag_you_can_embed_a_Flash_movie_that_contains_XSS
+    $data[] = [
+      '<EMBED SRC="http://ha.ckers.org/xss.swf" AllowScriptAccess="always"></EMBED>',
+      '',
+    ];
+
+    // You can EMBED SVG which can contain your XSS vector.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#You_can_EMBED_SVG_which_can_contain_your_XSS_vector
+    $data[] = [
+      // cspell:disable-next-line
+      '<EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED>',
+      '',
+    ];
+
+    // XML data island with CDATA obfuscation.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#XML_data_island_with_CDATA_obfuscation
+    $data[] = [
+      '<XML ID="xss"><I><B><IMG SRC="javas<!-- -->cript:alert(\'XSS\')"></B></I></XML><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>',
+      '<XML id="xss"><I><B><IMG>cript:alert(\'XSS\')"&gt;</B></I></XML><SPAN datasrc="#xss" datafld="B" dataformatas="HTML"></SPAN>',
+    ];
+
+    // Locally hosted XML with embedded JavaScript that is generated using an
+    // XML data island.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Locally_hosted_XML_with_embedded_JavaScript_that_is_generated_using_an_XML_data_island
+    // This one is irrelevant for Drupal; Drupal disallows XML uploads by
+    // default.
+
+    // HTML+TIME in XML.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#HTML.2BTIME_in_XML
+    $data[] = [
+      '<?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>alert("XSS")</SCRIPT>">',
+      '&lt;?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"&gt;&lt;?import namespace="t" implementation="#default#time2"&gt;<t set attributename="innerHTML">alert("XSS")"&gt;',
+    ];
+
+    // Assuming you can only fit in a few characters and it filters against
+    // ".js".
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Assuming_you_can_only_fit_in_a_few_characters_and_it_filters_against_.22.js.22
+    $data[] = ['<SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT>', ''];
+
+    // IMG Embedded commands.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#IMG_Embedded_commands
+    // This one is irrelevant for Drupal; this is actually a CSRF, for which
+    // Drupal has CSRF protection. See https://www.drupal.org/node/178896.
+
+    // Cookie manipulation.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Cookie_manipulation
+    $data[] = [
+      '<META HTTP-EQUIV="Set-Cookie" Content="UserID=<SCRIPT>alert(\'XSS\')</SCRIPT>">',
+      '<META http-equiv="Set-Cookie">alert(\'XSS\')"&gt;',
+    ];
+
+    // UTF-7 encoding.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#UTF-7_encoding
+    // This one is irrelevant for Drupal; Drupal *always* outputs UTF-8.
+
+    // XSS using HTML quote encapsulation.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#XSS_using_HTML_quote_encapsulation
+    $data[] = [
+      '<SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>',
+      '" SRC="http://ha.ckers.org/xss.js"&gt;',
+    ];
+    $data[] = [
+      '<SCRIPT =">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>',
+      '" SRC="http://ha.ckers.org/xss.js"&gt;',
+    ];
+    $data[] = [
+      '<SCRIPT a=">" \'\' SRC="http://ha.ckers.org/xss.js"></SCRIPT>',
+      '" \'\' SRC="http://ha.ckers.org/xss.js"&gt;',
+    ];
+    $data[] = [
+      '<SCRIPT "a=\'>\'" SRC="http://ha.ckers.org/xss.js"></SCRIPT>',
+      '\'" SRC="http://ha.ckers.org/xss.js"&gt;',
+    ];
+    $data[] = [
+      '<SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT>',
+      '` SRC="http://ha.ckers.org/xss.js"&gt;',
+    ];
+    $data[] = [
+      '<SCRIPT a=">\'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT>',
+      '\'&gt;" SRC="http://ha.ckers.org/xss.js"&gt;',
+    ];
+    $data[] = [
+      '<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT>',
+      'document.write("<SCRI>PT SRC="http://ha.ckers.org/xss.js"&gt;',
+    ];
+
+    // URL string evasion.
+    // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#URL_string_evasion
+    // This one is irrelevant for Drupal; Drupal doesn't forbid linking to some
+    // sites, it only forbids linking to any protocols other than those that are
+    // allowed.
+
+    // Test XSS filtering on data-attributes.
+    // @see \Drupal\editor\EditorXssFilter::filterXssDataAttributes()
+
+    // The following two test cases verify that XSS attack vectors are filtered.
+    $data[] = [
+      '<img src="butterfly.jpg" data-caption="&lt;script&gt;alert();&lt;/script&gt;" />',
+      '<img src="butterfly.jpg" data-caption="alert();">',
+    ];
+    $data[] = [
+      '<img src="butterfly.jpg" data-caption="&lt;EMBED SRC=&quot;http://ha.ckers.org/xss.swf&quot; AllowScriptAccess=&quot;always&quot;&gt;&lt;/EMBED&gt;" />',
+      '<img src="butterfly.jpg" data-caption>',
+    ];
+
+    // When including HTML-tags as visible content, they are double-escaped.
+    // This test case ensures that we leave that content unchanged.
+    $data[] = [
+      '<img src="butterfly.jpg" data-caption="&amp;lt;script&amp;gt;alert();&amp;lt;/script&amp;gt;" />',
+      '<img src="butterfly.jpg" data-caption="&amp;lt;script&amp;gt;alert();&amp;lt;/script&amp;gt;">',
+    ];
+
+    return $data;
+  }
+
+  /**
+   * Tests the method for filtering XSS.
+   *
+   * @param string $input
+   *   The input.
+   * @param string $expected_output
+   *   The expected output.
+   *
+   * @dataProvider providerTestFilterXss
+   */
+  public function testFilterXss($input, $expected_output): void {
+    $output = Standard::filterXss($input, $this->format);
+    $this->assertSame($expected_output, $output);
+  }
+
+  /**
+   * Tests removing disallowed tags and XSS prevention.
+   *
+   * \Drupal\Component\Utility\Xss::filter() has the ability to run in remove
+   * mode, in which it still applies the exact same filtering, with one
+   * exception: it no longer works with a list of allowed tags, but with a list
+   * of disallowed tags.
+   *
+   * @param string $value
+   *   The value to filter.
+   * @param string $expected
+   *   The string that is expected to be missing.
+   * @param string $message
+   *   The assertion message to display upon failure.
+   * @param array $disallowed_tags
+   *   (optional) The disallowed HTML tags to be passed to
+   *   \Drupal\Component\Utility\Xss::filter().
+   *
+   * @dataProvider providerTestDisallowMode
+   */
+  public function testDisallowMode($value, $expected, $message, array $disallowed_tags): void {
+    $value = Standard::filter($value, $disallowed_tags);
+    $this->assertSame($expected, $value, $message);
+  }
+
+  /**
+   * Data provider for testDisallowMode().
+   *
+   * @see testDisallowMode()
+   *
+   * @return array
+   *   An array of arrays containing the following elements:
+   *     - The value to filter.
+   *     - The value to expect after filtering.
+   *     - The assertion message.
+   *     - (optional) The disallowed HTML tags to be passed to
+   *       \Drupal\Component\Utility\Xss::filter().
+   */
+  public static function providerTestDisallowMode() {
+    return [
+      [
+        '<unknown style="visibility:hidden">Pink Fairy Armadillo</unknown><video src="gerenuk.mp4"><script>alert(0)</script>',
+        '<unknown>Pink Fairy Armadillo</unknown><video src="gerenuk.mp4">alert(0)',
+        'Disallow only the script tag',
+        ['script'],
+      ],
+      [
+        '<unknown style="visibility:hidden">Pink Fairy Armadillo</unknown><video src="gerenuk.mp4"><script>alert(0)</script>',
+        '<unknown>Pink Fairy Armadillo</unknown>alert(0)',
+        'Disallow both the script and video tags',
+        ['script', 'video'],
+      ],
+      // No real use case for this, but it is an edge case we must ensure works.
+      [
+        '<unknown style="visibility:hidden">Pink Fairy Armadillo</unknown><video src="gerenuk.mp4"><script>alert(0)</script>',
+        '<unknown>Pink Fairy Armadillo</unknown><video src="gerenuk.mp4"><script>alert(0)</script>',
+        'Disallow no tags',
+        [],
+      ],
+    ];
+  }
+
+}