[Mac] Add a feature flag to disable Javascript execution in Applescript

chrome/browser/ui/cocoa/applescript/tab_applescript.mm

Index: chrome/browser/ui/cocoa/applescript/tab_applescript.mm
diff --git a/chrome/browser/ui/cocoa/applescript/tab_applescript.mm b/chrome/browser/ui/cocoa/applescript/tab_applescript.mm
index 4552193c735a82cdb1e332c09676f99214d244dd..4bd80bf9844474f3d87315ae939cc560225046a8 100644
--- a/chrome/browser/ui/cocoa/applescript/tab_applescript.mm
+++ b/chrome/browser/ui/cocoa/applescript/tab_applescript.mm
@@ -14,6 +14,7 @@
 #include "chrome/browser/ui/cocoa/applescript/apple_event_util.h"
 #include "chrome/browser/ui/cocoa/applescript/error_applescript.h"
 #include "chrome/browser/ui/cocoa/applescript/metrics_applescript.h"
+#include "chrome/common/chrome_features.h"
 #include "chrome/common/chrome_isolated_world_ids.h"
 #include "chrome/common/url_constants.h"
 #include "components/sessions/core/session_id.h"
@@ -126,6 +127,14 @@ void ResumeAppleEventAndSendReply(NSAppleEventManagerSuspensionID suspension_id,
 }
 
 - (void)setURL:(NSString*)aURL {
+  GURL url(base::SysNSStringToUTF8(aURL));
+  if (!base::FeatureList::IsEnabled(features::kApplescriptExecuteJavascript)) {
+    if (url.SchemeIs(url::kJavaScriptScheme)) {
+      AppleScript::SetError(AppleScript::errJavascriptUnsupported);
+      return;
+    }
+  }
+
   // If a scripter sets a URL before the node is added save it at a temporary
   // location.
   if (!webContents_) {
@@ -133,7 +142,6 @@ void ResumeAppleEventAndSendReply(NSAppleEventManagerSuspensionID suspension_id,
     return;
   }
 
-  GURL url(base::SysNSStringToUTF8(aURL));
   // check for valid url.
   if (!url.is_empty() && !url.is_valid()) {
     AppleScript::SetError(AppleScript::errInvalidURL);
@@ -287,6 +295,11 @@ void ResumeAppleEventAndSendReply(NSAppleEventManagerSuspensionID suspension_id,
 }
 
 - (id)handlesExecuteJavascriptScriptCommand:(NSScriptCommand*)command {
+  if (!base::FeatureList::IsEnabled(features::kApplescriptExecuteJavascript)) {
+    AppleScript::SetError(AppleScript::errJavascriptUnsupported);
+    return nil;
+  }
+
   AppleScript::LogAppleScriptUMA(
       AppleScript::AppleScriptCommand::TAB_EXECUTE_JAVASCRIPT);
   content::RenderFrameHost* frame = webContents_->GetMainFrame();