[Mac] Add a feature flag to disable Javascript execution in Applescript

chrome/browser/ui/cocoa/applescript/tab_applescript.mm

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "chrome/browser/ui/cocoa/applescript/tab_applescript.h"
 
 #include "base/bind.h"
 #include "base/files/file_path.h"
 #include "base/logging.h"
 #import "base/mac/scoped_nsobject.h"
 #include "base/strings/sys_string_conversions.h"
 #include "chrome/browser/printing/print_view_manager.h"
 #include "chrome/browser/sessions/session_tab_helper.h"
 #include "chrome/browser/ui/cocoa/applescript/apple_event_util.h"
 #include "chrome/browser/ui/cocoa/applescript/error_applescript.h"
 #include "chrome/browser/ui/cocoa/applescript/metrics_applescript.h"
+#include "chrome/common/chrome_features.h"
 #include "chrome/common/chrome_isolated_world_ids.h"
 #include "chrome/common/url_constants.h"
 #include "components/sessions/core/session_id.h"
 #include "content/public/browser/navigation_controller.h"
 #include "content/public/browser/navigation_entry.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/save_page_type.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_delegate.h"
@@ skipping 92 matching lines @@
 
   NavigationEntry* entry = webContents_->GetController().GetActiveEntry();
   if (!entry) {
     return nil;
   }
   const GURL& url = entry->GetVirtualURL();
   return base::SysUTF8ToNSString(url.spec());
 }
 
 - (void)setURL:(NSString*)aURL {
+  GURL url(base::SysNSStringToUTF8(aURL));
+  if (!base::FeatureList::IsEnabled(features::kAppleScriptExecuteJavaScript) &&
+      url.SchemeIs(url::kJavaScriptScheme)) {
+    AppleScript::SetError(AppleScript::errJavaScriptUnsupported);
+    return;
+  }
+
   // If a scripter sets a URL before the node is added save it at a temporary
   // location.
   if (!webContents_) {
     [self setTempURL:aURL];
     return;
   }
 
-  GURL url(base::SysNSStringToUTF8(aURL));
   // check for valid url.
   if (!url.is_empty() && !url.is_valid()) {
     AppleScript::SetError(AppleScript::errInvalidURL);
     return;
   }
 
   NavigationEntry* entry = webContents_->GetController().GetActiveEntry();
   if (!entry)
     return;
 
@@ skipping 133 matching lines @@
   if (entry) {
     webContents_->OpenURL(
         OpenURLParams(GURL(content::kViewSourceScheme + std::string(":") +
                            entry->GetURL().spec()),
                       Referrer(), WindowOpenDisposition::NEW_FOREGROUND_TAB,
                       ui::PAGE_TRANSITION_LINK, false));
   }
 }
 
 - (id)handlesExecuteJavascriptScriptCommand:(NSScriptCommand*)command {
+  if (!base::FeatureList::IsEnabled(features::kAppleScriptExecuteJavaScript)) {
+    AppleScript::SetError(AppleScript::errJavaScriptUnsupported);
+    return nil;
+  }
+
   AppleScript::LogAppleScriptUMA(
       AppleScript::AppleScriptCommand::TAB_EXECUTE_JAVASCRIPT);
   content::RenderFrameHost* frame = webContents_->GetMainFrame();
   if (!frame) {
     NOTREACHED();
     return nil;
   }
 
   NSAppleEventManager* manager = [NSAppleEventManager sharedAppleEventManager];
   NSAppleEventManagerSuspensionID suspensionID =
       [manager suspendCurrentAppleEvent];
   content::RenderFrameHost::JavaScriptResultCallback callback =
       base::Bind(&ResumeAppleEventAndSendReply, suspensionID);
 
   base::string16 script = base::SysNSStringToUTF16(
       [[command evaluatedArguments] objectForKey:@"javascript"]);
   frame->ExecuteJavaScriptInIsolatedWorld(
       script, callback, chrome::ISOLATED_WORLD_ID_APPLESCRIPT);
 
   return nil;
 }
 
 @end