Update to Drupal 8.1.2. For more information, see https://www.drupal.org/project/drupal/releases/8.1.2

core/modules/dblog/src/Controller/DbLogController.php

@@ -4,6 +4,7 @@ namespace Drupal\dblog\Controller;
 
 use Drupal\Component\Utility\Html;
 use Drupal\Component\Utility\Unicode;
+use Drupal\Component\Utility\Xss;
 use Drupal\Core\Controller\ControllerBase;
 use Drupal\Core\Database\Connection;
 use Drupal\Core\Datetime\DateFormatterInterface;
@@ -234,7 +235,6 @@ class DbLogController extends ControllerBase {
    * @return array
    *   If the ID is located in the Database Logging table, a build array in the
    *   format expected by drupal_render();
-   *
    */
   public function eventDetails($event_id) {
     $build = array();
@@ -338,7 +338,7 @@ class DbLogController extends ControllerBase {
    *   The record from the watchdog table. The object properties are: wid, uid,
    *   severity, type, timestamp, message, variables, link, name.
    *
-   * @return string|false
+   * @return string|\Drupal\Core\StringTranslation\TranslatableMarkup|false
    *   The formatted log message or FALSE if the message or variables properties
    *   are not set.
    */
@@ -347,11 +347,11 @@ class DbLogController extends ControllerBase {
     if (isset($row->message) && isset($row->variables)) {
       // Messages without variables or user specified text.
       if ($row->variables === 'N;') {
-        $message = $row->message;
+        $message = Xss::filterAdmin($row->message);
       }
       // Message to translate with injected variables.
       else {
-        $message = $this->t($row->message, unserialize($row->variables));
+        $message = $this->t(Xss::filterAdmin($row->message), unserialize($row->variables));
       }
     }
     else {

core/modules/dblog/src/Plugin/rest/resource/DBLogResource.php

@@ -49,4 +49,5 @@ class DBLogResource extends ResourceBase {
 
     throw new BadRequestHttpException(t('No log entry ID was provided'));
   }
+
 }

core/modules/dblog/src/Tests/DbLogTest.php

@@ -83,6 +83,39 @@ class DbLogTest extends WebTestBase {
     $this->verifyReports(403);
   }
 
+  /**
+   * Test individual log event page.
+   */
+  public function testLogEventPage() {
+    // Login the admin user.
+    $this->drupalLogin($this->adminUser);
+
+    // Since referrer and location links vary by how the tests are run, inject
+    // fake log data to test these.
+    $context = [
+      'request_uri' => 'http://example.com?dblog=1',
+      'referer' => 'http://example.org?dblog=2',
+      'uid' => 0,
+      'channel' => 'testing',
+      'link' => 'foo/bar',
+      'ip' => '0.0.1.0',
+      'timestamp' => REQUEST_TIME,
+    ];
+    \Drupal::service('logger.dblog')->log(RfcLogLevel::NOTICE, 'Test message', $context);
+    $wid = db_query('SELECT MAX(wid) FROM {watchdog}')->fetchField();
+
+    // Verify the links appear correctly.
+    $this->drupalGet('admin/reports/dblog/event/' . $wid);
+    $this->assertLinkByHref($context['request_uri']);
+    $this->assertLinkByHref($context['referer']);
+
+    // Verify hostname.
+    $this->assertRaw($context['ip'], 'Found hostname on the detail page.');
+
+    // Verify severity.
+    $this->assertText('Notice', 'The severity was properly displayed on the detail page.');
+  }
+
   /**
    * Verifies setting of the database log row limit.
    *
@@ -218,7 +251,6 @@ class DbLogTest extends WebTestBase {
     if ($response == 200) {
       $this->assertText(t('Details'), 'DBLog event node was displayed');
     }
-
   }
 
   /**
@@ -737,6 +769,13 @@ class DbLogTest extends WebTestBase {
     // Make sure HTML tags are filtered out.
     $this->assertRaw('title="alert(&#039;foo&#039;);Lorem ipsum dolor sit amet, consectetur adipiscing &amp; elit. Entry #0">&lt;script&gt;alert(&#039;foo&#039;);&lt;/script&gt;Lorem ipsum dolor sit…</a>');
     $this->assertNoRaw("<script>alert('foo');</script>");
+
+    // Make sure HTML tags are filtered out in admin/reports/dblog/event/ too.
+    $this->generateLogEntries(1, ['message' => "<script>alert('foo');</script> <strong>Lorem ipsum</strong>"]);
+    $wid = db_query('SELECT MAX(wid) FROM {watchdog}')->fetchField();
+    $this->drupalGet('admin/reports/dblog/event/' . $wid);
+    $this->assertNoRaw("<script>alert('foo');</script>");
+    $this->assertRaw("alert('foo'); <strong>Lorem ipsum</strong>");
   }
 
 }

core/modules/dblog/src/Tests/Rest/DbLogResourceTest.php

@@ -61,4 +61,5 @@ class DbLogResourceTest extends RESTTestBase {
     $decoded = Json::decode($response);
     $this->assertEqual($decoded['error'], 'No log entry ID was provided', 'Response message is correct.');
   }
+
 }