From 4d78fc41750164fc2df85f1092549acada32f463 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Thu, 12 Mar 2026 12:42:21 +0100
Subject: [PATCH] Bug 42048: Add a Cypress test

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
---
 .../integration/KohaTable/KohaTable_spec.ts   | 44 +++++++++++++++++++
 1 file changed, 44 insertions(+)

diff --git a/t/cypress/integration/KohaTable/KohaTable_spec.ts b/t/cypress/integration/KohaTable/KohaTable_spec.ts
index a1d6f7b650..04877ba5ce 100644
--- a/t/cypress/integration/KohaTable/KohaTable_spec.ts
+++ b/t/cypress/integration/KohaTable/KohaTable_spec.ts
@@ -480,6 +480,50 @@ describe("kohaTable (using REST API)", () => {
                 cy.get("#searchresults .browse .filterByLetter:first").click();
             });
         });
+
+        it("Prevent XSS when using description", () => {
+            cy.task("buildSampleObjects", {
+                object: "patron",
+                count: RESTdefaultPageSize,
+                values: {},
+            }).then(patrons => {
+                // Needs more properties to not explode
+                // account_balace: balance_str.escapeHtml(...).format_price is not a function
+                patrons = patrons.map(p => ({ ...p, account_balance: 0 }));
+
+                cy.intercept("GET", "/api/v1/patrons*", {
+                    statusCode: 200,
+                    body: patrons,
+                    headers: {
+                        "X-Base-Total-Count": baseTotalCount,
+                        "X-Total-Count": baseTotalCount,
+                    },
+                });
+
+                cy.visit("/cgi-bin/koha/members/members-home.pl");
+
+                cy.get("#search_patron_filter").type(
+                    "<script>alert('boo');</script>"
+                );
+                cy.window().then(win => {
+                    win.categories_map = patrons.reduce((map, p) => {
+                        map[p.category_id.toLowerCase()] = p.category_id;
+                        return map;
+                    }, {});
+                });
+                cy.get("form.patron_search_form .branchcode_filter").select(
+                    "CPL"
+                );
+                cy.get("form.patron_search_form input[type='submit']").click();
+
+                cy.get(`#${table_id}_wrapper .dt-info`).contains(
+                    `Showing 1 to ${RESTdefaultPageSize} of ${baseTotalCount} entries`
+                );
+                cy.get("#searchresults .search_description").contains(
+                    "Standard starting with '<script>alert('boo');</script>'"
+                );
+            });
+        });
     });
 });