From 9a31c4286b1f4556e98aa178bda3bb667d0871ac Mon Sep 17 00:00:00 2001
From: Nick Kerr <nickk@labkey.com>
Date: Wed, 26 Feb 2025 10:38:39 -0800
Subject: [PATCH] Regression coverage for Issue 52402 (#2299)

---
 .../simpletest/resources/views/encodeButton.html  | 15 +++++++++++++++
 .../resources/views/encodeButton.view.xml         |  5 +++++
 src/org/labkey/test/tests/ClientAPITest.java      | 15 +++++++++++++++
 3 files changed, 35 insertions(+)
 create mode 100644 modules/simpletest/resources/views/encodeButton.html
 create mode 100644 modules/simpletest/resources/views/encodeButton.view.xml

diff --git a/modules/simpletest/resources/views/encodeButton.html b/modules/simpletest/resources/views/encodeButton.html
new file mode 100644
index 0000000000..2a2e8fb523
--- /dev/null
+++ b/modules/simpletest/resources/views/encodeButton.html
@@ -0,0 +1,15 @@
+<input id="firstName" type="text" value="<script>alert('XSS Input Success')</script><span>Loading XSS</span>" />
+<button class="btn btn-primary input-test" data-loading-text="<span>I'm Loading</span>" type="button">
+    Attempt XSS injection
+</button>
+<script type="text/javascript" nonce="<%=scriptNonce%>">
+    // Issue 52402: Verify the "loadingText" attribute for a bootstrap button() is properly encoded.
+    // See ClientAPITest.testBootstrapButtonEncoding
+    $(function () {
+        $('.input-test').click(function () {
+            let inputValue = $('#firstName').val();
+            $(this).data('loadingText', inputValue);
+            $(this).button('loading', inputValue);
+        });
+    });
+</script>
diff --git a/modules/simpletest/resources/views/encodeButton.view.xml b/modules/simpletest/resources/views/encodeButton.view.xml
new file mode 100644
index 0000000000..b2e99771aa
--- /dev/null
+++ b/modules/simpletest/resources/views/encodeButton.view.xml
@@ -0,0 +1,5 @@
+<view xmlns="http://labkey.org/data/xml/view">
+    <dependencies>
+        <dependency path="internal/jQuery" />
+    </dependencies>
+</view>
\ No newline at end of file
diff --git a/src/org/labkey/test/tests/ClientAPITest.java b/src/org/labkey/test/tests/ClientAPITest.java
index 577ec82153..823c16d9a4 100644
--- a/src/org/labkey/test/tests/ClientAPITest.java
+++ b/src/org/labkey/test/tests/ClientAPITest.java
@@ -1546,6 +1546,21 @@ public void suggestedColumnsInQueryDetailsTest() throws Exception
                 columns.stream().noneMatch(col -> col.getName().equalsIgnoreCase("Container")));
     }
 
+    @Test
+    public void testBootstrapButtonEncoding()
+    {
+        assumeTestModules();
+
+        beginAt(WebTestHelper.buildURL("simpletest", getProjectName(), "encodeButton"));
+        var buttonLocator = Locator.tagWithClass("button", "input-test");
+        waitForElement(buttonLocator);
+
+        // Prior to the patch for Issue 52402 clicking the button would result in a XSS injection
+        // which would result in an UnhandledAlertException.
+        click(buttonLocator);
+        waitForElement(Locator.buttonContainingText("<script>alert('XSS Input Success')</script><span>Loading XSS</span>"));
+    }
+
     @Override
     public BrowserType bestBrowser()
     {