[Mac] Add a feature flag to disable Javascript execution in Applescript

chrome/browser/ui/cocoa/applescript/bookmark_item_applescript.mm

Index: chrome/browser/ui/cocoa/applescript/bookmark_item_applescript.mm
diff --git a/chrome/browser/ui/cocoa/applescript/bookmark_item_applescript.mm b/chrome/browser/ui/cocoa/applescript/bookmark_item_applescript.mm
index 86a0aa6f6f847a431e36491c4a36ab3c08ac6fe5..206de4006c959779692dd52194bba49a5bf3da53 100644
--- a/chrome/browser/ui/cocoa/applescript/bookmark_item_applescript.mm
+++ b/chrome/browser/ui/cocoa/applescript/bookmark_item_applescript.mm
@@ -7,6 +7,7 @@
 #include "base/strings/sys_string_conversions.h"
 #include "chrome/browser/profiles/profile_manager.h"
 #import "chrome/browser/ui/cocoa/applescript/error_applescript.h"
+#include "chrome/common/chrome_features.h"
 #include "components/bookmarks/browser/bookmark_model.h"
 
 using bookmarks::BookmarkModel;
@@ -45,6 +46,13 @@ using bookmarks::BookmarkNode;
 }
 
 - (void)setURL:(NSString*)aURL {
+  GURL url(base::SysNSStringToUTF8(aURL));
+  if (!base::FeatureList::IsEnabled(features::kAppleScriptExecuteJavaScript) &&
+      url.SchemeIs(url::kJavaScriptScheme)) {
+    AppleScript::SetError(AppleScript::errJavaScriptUnsupported);
+    return;
+  }
+
   // If a scripter sets a URL before the node is added, URL is saved at a
   // temporary location.
   if (!bookmarkNode_) {
@@ -56,7 +64,6 @@ using bookmarks::BookmarkNode;
   if (!model)
     return;
 
-  GURL url(base::SysNSStringToUTF8(aURL));
   if (!url.is_valid()) {
     AppleScript::SetError(AppleScript::errInvalidURL);
     return;