spec: "disablewebsecurity" attribute

spec/webview-spec.coffee

@@ -70,6 +70,36 @@ describe '<webview> tag', ->
       webview.src = "file://#{fixtures}/pages/referrer.html"
       document.body.appendChild webview
 
+  describe 'disablewebsecurity attribute', ->
+    it 'does not disable web security when not set', (done) ->
+      src = "
+        <script src='file://#{__dirname}/static/jquery-2.0.3.min.js'></script>
+        <script>console.log('ok');</script>
+      "
+      encoded = btoa(unescape(encodeURIComponent(src)))
+      listener = (e) ->
+        assert /Not allowed to load local resource/.test(e.message)
+        webview.removeEventListener 'console-message', listener
+        done()
+      webview.addEventListener 'console-message', listener
+      webview.src = "data:text/html;base64,#{encoded}"
+      document.body.appendChild webview
+
+    it 'disables web security when set', (done) ->
+      src = "
+        <script src='file://#{__dirname}/static/jquery-2.0.3.min.js'></script>
+        <script>console.log('ok');</script>
+      "
+      encoded = btoa(unescape(encodeURIComponent(src)))
+      listener = (e) ->
+        assert.equal e.message, 'ok'
+        webview.removeEventListener 'console-message', listener
+        done()
+      webview.addEventListener 'console-message', listener
+      webview.setAttribute 'disablewebsecurity', ''
+      webview.src = "data:text/html;base64,#{encoded}"
+      document.body.appendChild webview
+
   describe 'new-window event', ->
     it 'emits when window.open is called', (done) ->
       webview.addEventListener 'new-window', (e) ->