MC-3578: Script tag removal

Author: irenelagno

dev/tests/integration/testsuite/Magento/PageBuilder/Model/Stage/Renderer/CmsStaticBlockTest.php

@@ -0,0 +1,33 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\PageBuilder\Model\Stage\Renderer;
+
+class CmsStaticBlockTest extends \PHPUnit\Framework\TestCase
+{
+    /**
+     * @magentoDataFixture Magento/PageBuilder/_files/block_with_script.php
+     * @magentoDataFixture Magento/Variable/_files/variable.php
+     */
+    public function testRender()
+    {
+        /** @var \Magento\Cms\Model\Block $cmsBlock */
+        $cmsBlock = \Magento\TestFramework\Helper\Bootstrap::getObjectManager()->create(
+            \Magento\Cms\Model\Block::class
+        );
+        $cmsBlock->load('block_with_script', 'identifier');
+
+        $blockRenderer = \Magento\TestFramework\Helper\Bootstrap::getObjectManager()->create(
+            \Magento\PageBuilder\Model\Stage\Renderer\CmsStaticBlock::class
+        );
+        $result = $blockRenderer->render(['block_id' => $cmsBlock->getId()]);
+        $this->assertArrayHasKey('content', $result);
+        $this->assertNotContains('<script>', $result['content']);
+        $this->assertContains('<p>Config value: "http://example.com/".</p>', $result['content']);
+        $this->assertContains('<p>Custom variable: "HTML Value".</p>', $result['content']);
+    }
+}

dev/tests/integration/testsuite/Magento/PageBuilder/_files/block_with_script.php

@@ -0,0 +1,28 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+/** @var $block \Magento\Cms\Model\Block */
+$block = \Magento\TestFramework\Helper\Bootstrap::getObjectManager()->create(\Magento\Cms\Model\Block::class);
+$block->setTitle(
+    'CMS Block Title'
+)->setIdentifier(
+    'block_with_script'
+)->setContent(
+    '<h1>Fixture Block Title</h1>
+<a href="{{store url=""}}">store url</a>
+<p>Config value: "{{config path="web/unsecure/base_url"}}".</p>
+<p>Custom variable: "{{customvar code="variable_code"}}".</p>
+<script>alert("hello")</script>
+'
+)->setIsActive(
+    1
+)->setStores(
+    [
+        \Magento\TestFramework\Helper\Bootstrap::getObjectManager()->get(
+            \Magento\Store\Model\StoreManagerInterface::class
+        )->getStore()->getId()
+    ]
+)->save();