Disallow JS execution on WebUI pages.

Disallow JS execution on WebUI pages.

As a side effect TapWebViewElementWithId now actually opens windows instead of
popups, which is definitely a correct behavior.

BUG=692378
Review-Url: https://codereview.chromium.org/2761173002
Cr-Commit-Position: refs/heads/master@{#459149}
Committed: https://chromium.googlesource.com/chromium/src/+/cfe21b64486c2a1bfed6e0e7304fcf8f1748ccfe

[Eugene But (OOO till 7-30), 2017-03-21 00:49:18]

The CQ bit was checked by eugenebut@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-03-21 00:50:27]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-03-21 01:06:31]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-03-21 01:06:32]

Dry run: This issue passed the CQ dry run.

[Eugene But (OOO till 7-30), 2017-03-21 21:43:55]

The CQ bit was checked by eugenebut@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-03-21 21:44:40]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-03-21 22:00:01]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-03-21 22:00:02]

Dry run: This issue passed the CQ dry run.

[Eugene But (OOO till 7-30), 2017-03-22 01:48:04]

Description was changed from

==========
Disallow JS execution on WebUI pages.

BUG=692378
==========

to

==========
Disallow JS execution on WebUI pages.

As a side effect TapWebViewElementWithId now actually opens windows instead of
popups, which is definitely a correct behavior.

BUG=692378
==========

[Eugene But (OOO till 7-30), 2017-03-22 01:48:23]

The CQ bit was checked by eugenebut@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-03-22 01:49:13]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-03-22 03:51:03]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-03-22 03:51:04]

Dry run: Try jobs failed on following builders:
  ios-simulator on master.tryserver.chromium.mac (JOB_TIMED_OUT, build hasn't
started yet, builder probably lacks capacity)
  ios-simulator-xcode-clang on master.tryserver.chromium.mac (JOB_TIMED_OUT,
build hasn't started yet, builder probably lacks capacity)

[Eugene But (OOO till 7-30), 2017-03-22 16:34:11]

The CQ bit was checked by eugenebut@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-03-22 16:34:27]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-03-22 16:48:24]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-03-22 16:48:25]

Dry run: This issue passed the CQ dry run.

[Eugene But (OOO till 7-30), 2017-03-22 20:21:59]

The CQ bit was checked by eugenebut@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-03-22 20:22:38]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-03-22 20:38:13]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-03-22 20:38:14]

Dry run: This issue passed the CQ dry run.

[Eugene But (OOO till 7-30), 2017-03-22 20:56:41]

eugenebut@chromium.org changed reviewers:
+ lpromero@chromium.org

[Eugene But (OOO till 7-30), 2017-03-22 20:56:42]

PTAL. History tests failures are not related to this change.

[lpromero, 2017-03-23 12:43:48]

lgtm

https://codereview.chromium.org/2761173002/diff/100001/ios/chrome/browser/ui/...
File ios/chrome/browser/ui/toolbar/toolbar_egtest.mm (right):

https://codereview.chromium.org/2761173002/diff/100001/ios/chrome/browser/ui/...
ios/chrome/browser/ui/toolbar/toolbar_egtest.mm:360: // Loads WebUI page, types
JavaScript into Omnibox and verify that alert is not
Nit: verifies

https://codereview.chromium.org/2761173002/diff/100001/ios/chrome/browser/ui/...
ios/chrome/browser/ui/toolbar/toolbar_egtest.mm:361: // displayed. WebUI pages
have elevated previledges and should not allow script
Nit: privileges

https://codereview.chromium.org/2761173002/diff/100001/ios/web/web_state/ui/c...
File ios/web/web_state/ui/crw_web_controller.mm (right):

https://codereview.chromium.org/2761173002/diff/100001/ios/web/web_state/ui/c...
ios/web/web_state/ui/crw_web_controller.mm:2299: // For security reasons
executing JavaScript on pages with app-specific URLs
Nit: Add a comma after "reasons".

https://codereview.chromium.org/2761173002/diff/100001/ios/web/web_state/ui/c...
File ios/web/web_state/ui/crw_web_controller_unittest.mm (right):

https://codereview.chromium.org/2761173002/diff/100001/ios/web/web_state/ui/c...
ios/web/web_state/ui/crw_web_controller_unittest.mm:918: // URLs have elevatied
previledges and JavaScript execution should not be
nit: elevated privileges

[Eugene But (OOO till 7-30), 2017-03-23 17:26:58]

The CQ bit was checked by eugenebut@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-03-23 17:27:24]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-03-23 17:42:14]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-03-23 17:42:15]

Dry run: This issue passed the CQ dry run.

[Eugene But (OOO till 7-30), 2017-03-23 17:45:08]

Thanks!

https://codereview.chromium.org/2761173002/diff/100001/ios/chrome/browser/ui/...
File ios/chrome/browser/ui/toolbar/toolbar_egtest.mm (right):

https://codereview.chromium.org/2761173002/diff/100001/ios/chrome/browser/ui/...
ios/chrome/browser/ui/toolbar/toolbar_egtest.mm:360: // Loads WebUI page, types
JavaScript into Omnibox and verify that alert is not
On 2017/03/23 12:43:48, lpromero wrote:
> Nit: verifies

Done.

https://codereview.chromium.org/2761173002/diff/100001/ios/chrome/browser/ui/...
ios/chrome/browser/ui/toolbar/toolbar_egtest.mm:361: // displayed. WebUI pages
have elevated previledges and should not allow script
On 2017/03/23 12:43:48, lpromero wrote:
> Nit: privileges

Done.

https://codereview.chromium.org/2761173002/diff/100001/ios/web/web_state/ui/c...
File ios/web/web_state/ui/crw_web_controller.mm (right):

https://codereview.chromium.org/2761173002/diff/100001/ios/web/web_state/ui/c...
ios/web/web_state/ui/crw_web_controller.mm:2299: // For security reasons
executing JavaScript on pages with app-specific URLs
On 2017/03/23 12:43:48, lpromero wrote:
> Nit: Add a comma after "reasons".

Done.

https://codereview.chromium.org/2761173002/diff/100001/ios/web/web_state/ui/c...
File ios/web/web_state/ui/crw_web_controller_unittest.mm (right):

https://codereview.chromium.org/2761173002/diff/100001/ios/web/web_state/ui/c...
ios/web/web_state/ui/crw_web_controller_unittest.mm:918: // URLs have elevatied
previledges and JavaScript execution should not be
On 2017/03/23 12:43:48, lpromero wrote:
> nit: elevated privileges

Done.

[Eugene But (OOO till 7-30), 2017-03-23 17:45:13]

The CQ bit was checked by eugenebut@chromium.org

[Eugene But (OOO till 7-30), 2017-03-23 17:45:13]

The patchset sent to the CQ was uploaded after l-g-t-m from
lpromero@chromium.org
Link to the patchset: https://codereview.chromium.org/2761173002/#ps120001
(title: "Addressed review comments")

[commit-bot: I haz the power, 2017-03-23 17:45:52]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-03-23 18:18:01]

CQ is committing da patch.

Bot data: {"patchset_id": 120001, "attempt_start_ts": 1490291113656170,
"parent_rev": "c9aec66ca15c3630dcaeff94a0ffdc3068c11baa", "commit_rev":
"cfe21b64486c2a1bfed6e0e7304fcf8f1748ccfe"}

[commit-bot: I haz the power, 2017-03-23 18:18:52]

Description was changed from

==========
Disallow JS execution on WebUI pages.

As a side effect TapWebViewElementWithId now actually opens windows instead of
popups, which is definitely a correct behavior.

BUG=692378
==========

to

==========
Disallow JS execution on WebUI pages.

As a side effect TapWebViewElementWithId now actually opens windows instead of
popups, which is definitely a correct behavior.

BUG=692378

Review-Url: https://codereview.chromium.org/2761173002
Cr-Commit-Position: refs/heads/master@{#459149}
Committed:
https://chromium.googlesource.com/chromium/src/+/cfe21b64486c2a1bfed6e0e7304f...
==========

[commit-bot: I haz the power, 2017-03-23 18:18:54]

Committed patchset #7 (id:120001) as
https://chromium.googlesource.com/chromium/src/+/cfe21b64486c2a1bfed6e0e7304f...