1 files changed, 154 insertions, 0 deletions
diff --git a/dom/security/test/csp/file_evalscript_main.js b/dom/security/test/csp/file_evalscript_main.js
new file mode 100644
index 000000000..64ab05664
--- /dev/null
+++ b/dom/security/test/csp/file_evalscript_main.js
@@ -0,0 +1,154 @@
+// some javascript for the CSP eval() tests
+
+function logResult(str, passed) {
+  var elt = document.createElement('div');
+  var color = passed ? "#cfc;" : "#fcc";
+  elt.setAttribute('style', 'background-color:' + color + '; width:100%; border:1px solid black; padding:3px; margin:4px;');
+  elt.innerHTML = str;
+  document.body.appendChild(elt);
+}
+
+window._testResults = {};
+
+// check values for return values from blocked timeout or intervals
+var verifyZeroRetVal = (function(window) {
+  return function(val, details) {
+    logResult((val === 0 ? "PASS: " : "FAIL: ") + "Blocked interval/timeout should have zero return value; " + details, val === 0);
+    window.parent.verifyZeroRetVal(val, details);
+  };})(window);
+
+// callback for when stuff is allowed by CSP
+var onevalexecuted = (function(window) {
+    return function(shouldrun, what, data) {
+      window._testResults[what] = "ran";
+      window.parent.scriptRan(shouldrun, what, data);
+      logResult((shouldrun ? "PASS: " : "FAIL: ") + what + " : " + data, shouldrun);
+    };})(window);
+
+// callback for when stuff is blocked
+var onevalblocked = (function(window) {
+    return function(shouldrun, what, data) {
+      window._testResults[what] = "blocked";
+      window.parent.scriptBlocked(shouldrun, what, data);
+      logResult((shouldrun ? "FAIL: " : "PASS: ") + what + " : " + data, !shouldrun);
+    };})(window);
+
+
+// Defer until document is loaded so that we can write the pretty result boxes
+// out.
+addEventListener('load', function() {
+  // setTimeout(String) test -- mutate something in the window._testResults
+  // obj, then check it.
+  {
+    var str_setTimeoutWithStringRan = 'onevalexecuted(false, "setTimeout(String)", "setTimeout with a string was enabled.");';
+    function fcn_setTimeoutWithStringCheck() {
+      if (this._testResults["setTimeout(String)"] !== "ran") {
+        onevalblocked(false, "setTimeout(String)",
+                      "setTimeout with a string was blocked");
+      }
+    }
+    setTimeout(fcn_setTimeoutWithStringCheck.bind(window), 10);
+    var res = setTimeout(str_setTimeoutWithStringRan, 10);
+    verifyZeroRetVal(res, "setTimeout(String)");
+  }
+
+  // setInterval(String) test -- mutate something in the window._testResults
+  // obj, then check it.
+  {
+    var str_setIntervalWithStringRan = 'onevalexecuted(false, "setInterval(String)", "setInterval with a string was enabled.");';
+    function fcn_setIntervalWithStringCheck() {
+      if (this._testResults["setInterval(String)"] !== "ran") {
+        onevalblocked(false, "setInterval(String)",
+                      "setInterval with a string was blocked");
+      }
+    }
+    setTimeout(fcn_setIntervalWithStringCheck.bind(window), 10);
+    var res = setInterval(str_setIntervalWithStringRan, 10);
+    verifyZeroRetVal(res, "setInterval(String)");
+
+    // emergency cleanup, just in case.
+    if (res != 0) {
+      setTimeout(function () { clearInterval(res); }, 15);
+    }
+  }
+
+  // setTimeout(function) test -- mutate something in the window._testResults
+  // obj, then check it.
+  {
+    function fcn_setTimeoutWithFunctionRan() {
+      onevalexecuted(true, "setTimeout(function)",
+                    "setTimeout with a function was enabled.")
+    }
+    function fcn_setTimeoutWithFunctionCheck() {
+      if (this._testResults["setTimeout(function)"] !== "ran") {
+        onevalblocked(true, "setTimeout(function)",
+                      "setTimeout with a function was blocked");
+      }
+    }
+    setTimeout(fcn_setTimeoutWithFunctionRan.bind(window), 10);
+    setTimeout(fcn_setTimeoutWithFunctionCheck.bind(window), 10);
+  }
+
+  // eval() test -- should throw exception as per spec
+  try {
+    eval('onevalexecuted(false, "eval(String)", "eval() was enabled.");');
+  } catch (e) {
+    onevalblocked(false, "eval(String)",
+                  "eval() was blocked");
+  }
+
+  // eval(foo,bar) test -- should throw exception as per spec
+  try {
+    eval('onevalexecuted(false, "eval(String,scope)", "eval() was enabled.");',1);
+  } catch (e) {
+    onevalblocked(false, "eval(String,object)",
+                  "eval() with scope was blocked");
+  }
+
+  // [foo,bar].sort(eval) test -- should throw exception as per spec
+  try {
+    ['onevalexecuted(false, "[String, obj].sort(eval)", "eval() was enabled.");',1].sort(eval);
+  } catch (e) {
+    onevalblocked(false, "[String, obj].sort(eval)",
+                  "eval() with scope via sort was blocked");
+  }
+
+  // [].sort.call([foo,bar], eval) test -- should throw exception as per spec
+  try {
+    [].sort.call(['onevalexecuted(false, "[String, obj].sort(eval)", "eval() was enabled.");',1], eval);
+  } catch (e) {
+    onevalblocked(false, "[].sort.call([String, obj], eval)",
+                  "eval() with scope via sort/call was blocked");
+  }
+
+  // new Function() test -- should throw exception as per spec
+  try {
+    var fcn = new Function('onevalexecuted(false, "new Function(String)", "new Function(String) was enabled.");');
+    fcn();
+  } catch (e) {
+    onevalblocked(false, "new Function(String)",
+                  "new Function(String) was blocked.");
+  }
+
+  // setTimeout(eval, 0, str)
+  {
+    // error is not catchable here, instead, we're going to side-effect
+    // 'worked'.
+    var worked = false;
+
+    setTimeout(eval, 0, 'worked = true');
+    setTimeout(function(worked) {
+                  if (worked) {
+                    onevalexecuted(false, "setTimeout(eval, 0, str)",
+                                    "setTimeout(eval, 0, string) was enabled.");
+                  } else {
+                    onevalblocked(false, "setTimeout(eval, 0, str)",
+                                        "setTimeout(eval, 0, str) was blocked.");
+                  }
+                }, 0, worked);
+  }
+
+}, false);
+
+
+