fixes and tests for webview 'webpreferences' attr

lib/browser/guest-view-manager.js

@@ -188,6 +188,7 @@ const attachGuest = function (embedder, elementInstanceId, guestInstanceId, para
   // this uses the same parsing rules as window.open uses for its features
   if (typeof params.webpreferences === 'string') {
     // split the attribute's value by ','
+    let i, len
     let webpreferencesTokens = params.webpreferences.split(/,\s*/)
     for (i = 0, len = webpreferencesTokens.length; i < len; i++) {
       // expected form is either a name by itself (true boolean flag)
@@ -195,8 +196,8 @@ const attachGuest = function (embedder, elementInstanceId, guestInstanceId, para
       // split the tokens by '='
       let pref = webpreferencesTokens[i]
       let prefTokens = pref.split(/\s*=/)
-      name = prefTokens[0]
-      value = prefTokens[1]
+      let name = prefTokens[0]
+      let value = prefTokens[1]
       if (!name) continue
 
       // interpret the value as a boolean, if possible 

lib/renderer/web-view/web-view-attributes.js

@@ -335,7 +335,7 @@ WebViewImpl.prototype.setupWebViewAttributes = function () {
   this.attributes[webViewConstants.ATTRIBUTE_BLINKFEATURES] = new BlinkFeaturesAttribute(this)
   this.attributes[webViewConstants.ATTRIBUTE_DISABLEBLINKFEATURES] = new DisableBlinkFeaturesAttribute(this)
   this.attributes[webViewConstants.ATTRIBUTE_GUESTINSTANCE] = new GuestInstanceAttribute(this)
-  this.attributes[webviewConstants.ATTRIBUTE_WEBPREFERENCES] = new WebPreferencesAttribute(this)
+  this.attributes[webViewConstants.ATTRIBUTE_WEBPREFERENCES] = new WebPreferencesAttribute(this)
 
   const autosizeAttributes = [webViewConstants.ATTRIBUTE_MAXHEIGHT, webViewConstants.ATTRIBUTE_MAXWIDTH, webViewConstants.ATTRIBUTE_MINHEIGHT, webViewConstants.ATTRIBUTE_MINWIDTH]
   autosizeAttributes.forEach((attribute) => {

spec/webview-spec.js

@@ -406,6 +406,33 @@ describe('<webview> tag', function () {
     })
   })
 
+  describe('webpreferences attribute', function () {
+    it('can enable nodeintegration', function (done) {
+      webview.addEventListener('console-message', function (e) {
+        assert.equal(e.message, 'function object object')
+        done()
+      })
+      webview.setAttribute('webpreferences', 'nodeIntegration')
+      webview.src = 'file://' + fixtures + '/pages/d.html'
+      document.body.appendChild(webview)
+    })
+
+    it('can disables web security and enable nodeintegration', function (done) {
+      var jqueryPath = path.join(__dirname, '/static/jquery-2.0.3.min.js')
+      var src = `<script src='file://${jqueryPath}'></script> <script>console.log('ok '+(typeof require));</script>`
+      var encoded = btoa(unescape(encodeURIComponent(src)))
+      var listener = function (e) {
+        assert.equal(e.message, 'ok function')
+        webview.removeEventListener('console-message', listener)
+        done()
+      }
+      webview.addEventListener('console-message', listener)
+      webview.setAttribute('webpreferences', 'webSecurity=no, nodeIntegration=yes')
+      webview.src = 'data:text/html;base64,' + encoded
+      document.body.appendChild(webview)
+    })
+  })
+
   describe('new-window event', function () {
     if (process.env.TRAVIS === 'true' && process.platform === 'darwin') {
       return