Disallow JS execution on WebUI pages.

ios/chrome/browser/ui/toolbar/toolbar_egtest.mm

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import <EarlGrey/EarlGrey.h>
 #import <XCTest/XCTest.h>
 
 #include "base/ios/ios_util.h"
 #include "components/strings/grit/components_strings.h"
 #import "ios/chrome/browser/ui/commands/generic_chrome_command.h"
@@ skipping 322 matching lines @@
   [[EarlGrey selectElementWithMatcher:chrome_test_util::Omnibox()]
       assertWithMatcher:chrome_test_util::OmniboxText("")];
 }
 
 // Types JavaScript into Omnibox and verify that an alert is displayed.
 - (void)testTypeJavaScriptIntoOmnibox {
   // TODO(crbug.com/642544): Enable the test for iPad when typing bug is fixed.
   if (IsIPadIdiom() && base::ios::IsRunningOnIOS10OrLater()) {
     EARL_GREY_TEST_DISABLED(@"Disabled for iOS10 iPad due to a typing bug.");
   }
-  [ChromeEarlGrey loadURL:GURL("chrome://version")];
+
+  std::map<GURL, std::string> responses;
+  GURL URL = web::test::HttpServer::MakeUrl("http://foo");
+  responses[URL] = "bar";
+  web::test::SetUpSimpleHttpServer(responses);
+  [ChromeEarlGrey loadURL:GURL(URL)];
+
   [[EarlGrey selectElementWithMatcher:chrome_test_util::Omnibox()]
       performAction:grey_typeText(@"javascript:alert('Hello');")];
 
   [[EarlGrey selectElementWithMatcher:grey_accessibilityID(@"Go")]
       performAction:grey_tap()];
 
   [[EarlGrey selectElementWithMatcher:grey_accessibilityLabel(@"Hello")]
       assertWithMatcher:grey_notNil()];
 }
 
+// Loads WebUI page, types JavaScript into Omnibox and verifies that alert is
+// not displayed. WebUI pages have elevated privileges and should not allow
+// script execution.
+- (void)testTypeJavaScriptIntoOmniboxWithWebUIPage {
+  // TODO(crbug.com/642544): Enable the test for iPad when typing bug is fixed.
+  if (IsIPadIdiom() && base::ios::IsRunningOnIOS10OrLater()) {
+    EARL_GREY_TEST_DISABLED(@"Disabled for iOS10 iPad due to a typing bug.");
+  }
+  [ChromeEarlGrey loadURL:GURL("chrome://version")];
+  [[EarlGrey selectElementWithMatcher:chrome_test_util::Omnibox()]
+      performAction:grey_typeText(@"javascript:alert('Hello');")];
+
+  [[EarlGrey selectElementWithMatcher:grey_accessibilityID(@"Go")]
+      performAction:grey_tap()];
+
+  [[EarlGrey selectElementWithMatcher:grey_accessibilityLabel(@"Hello")]
+      assertWithMatcher:grey_nil()];
+}
+
 // Tests typing in the omnibox.
 - (void)testToolbarOmniboxTyping {
   // TODO(crbug.com/642559): Enable this test for iPad when typing bug is fixed.
   if (IsIPadIdiom()) {
     EARL_GREY_TEST_DISABLED(@"Disabled for iPad due to a simulator bug.");
   }
   SelectNewTabPagePanel(NewTabPage::kMostVisitedPanel);
 
   id<GREYMatcher> locationbarButton = grey_allOf(
       grey_accessibilityLabel(l10n_util::GetNSString(IDS_OMNIBOX_EMPTY_HINT)),
@@ skipping 78 matching lines @@
   NSString* clearText = IsIPadIdiom() ? typingShield : cancelButtonText;
 
   [[EarlGrey selectElementWithMatcher:grey_accessibilityLabel(clearText)]
       performAction:grey_tap()];
   [[EarlGrey selectElementWithMatcher:chrome_test_util::Omnibox()]
       assertWithMatcher:chrome_test_util::OmniboxText("")];
 
   SelectNewTabPagePanel(NewTabPage::kMostVisitedPanel);
 }
 @end