Disallow JS execution on WebUI pages.

ios/chrome/browser/ui/toolbar/toolbar_egtest.mm

Index: ios/chrome/browser/ui/toolbar/toolbar_egtest.mm
diff --git a/ios/chrome/browser/ui/toolbar/toolbar_egtest.mm b/ios/chrome/browser/ui/toolbar/toolbar_egtest.mm
index a4aa7355b100a5b2506f83a4d317bce7b68ee919..b42cc265e8cc4abdc4dd2ffa84838b45e66b33a9 100644
--- a/ios/chrome/browser/ui/toolbar/toolbar_egtest.mm
+++ b/ios/chrome/browser/ui/toolbar/toolbar_egtest.mm
@@ -340,7 +340,13 @@ void SelectNewTabPagePanel(NewTabPage::PanelIdentifier panel_type) {
   if (IsIPadIdiom() && base::ios::IsRunningOnIOS10OrLater()) {
     EARL_GREY_TEST_DISABLED(@"Disabled for iOS10 iPad due to a typing bug.");
   }
-  [ChromeEarlGrey loadURL:GURL("chrome://version")];
+
+  std::map<GURL, std::string> responses;
+  GURL URL = web::test::HttpServer::MakeUrl("http://foo");
+  responses[URL] = "bar";
+  web::test::SetUpSimpleHttpServer(responses);
+  [ChromeEarlGrey loadURL:GURL(URL)];
+
   [[EarlGrey selectElementWithMatcher:chrome_test_util::Omnibox()]
       performAction:grey_typeText(@"javascript:alert('Hello');")];
 
@@ -351,6 +357,25 @@ void SelectNewTabPagePanel(NewTabPage::PanelIdentifier panel_type) {
       assertWithMatcher:grey_notNil()];
 }
 
+// Loads WebUI page, types JavaScript into Omnibox and verify that alert is not

[lpromero, 2017/03/23 12:43:48]

Nit: verifies

[Eugene But (OOO till 7-30), 2017/03/23 17:45:08]

Done.

+// displayed. WebUI pages have elevated previledges and should not allow script

[lpromero, 2017/03/23 12:43:48]

Nit: privileges

[Eugene But (OOO till 7-30), 2017/03/23 17:45:08]

Done.

+// execution.
+- (void)testTypeJavaScriptIntoOmniboxWithWebUIPage {
+  // TODO(crbug.com/642544): Enable the test for iPad when typing bug is fixed.
+  if (IsIPadIdiom() && base::ios::IsRunningOnIOS10OrLater()) {
+    EARL_GREY_TEST_DISABLED(@"Disabled for iOS10 iPad due to a typing bug.");
+  }
+  [ChromeEarlGrey loadURL:GURL("chrome://version")];
+  [[EarlGrey selectElementWithMatcher:chrome_test_util::Omnibox()]
+      performAction:grey_typeText(@"javascript:alert('Hello');")];
+
+  [[EarlGrey selectElementWithMatcher:grey_accessibilityID(@"Go")]
+      performAction:grey_tap()];
+
+  [[EarlGrey selectElementWithMatcher:grey_accessibilityLabel(@"Hello")]
+      assertWithMatcher:grey_nil()];
+}
+
 // Tests typing in the omnibox.
 - (void)testToolbarOmniboxTyping {
   SelectNewTabPagePanel(NewTabPage::kMostVisitedPanel);