create(\Magento\Catalog\Api\ProductRepositoryInterface::class); $product = $productRepository->get('product-with-xss'); $reviewId = \Magento\TestFramework\Helper\Bootstrap::getObjectManager()->create( \Magento\Review\Model\Review::class )->load( $product->getId(), 'entity_pk_value' )->getId(); $this->dispatch('backend/review/product/edit/id/' . $reviewId); $responseBody = $this->getResponse()->getBody(); $this->assertStringContainsString('<script>alert("xss");</script>', $responseBody); $this->assertStringNotContainsString('', $responseBody); } }