From e7962c7ba2421c809134f38fd82d0e5ca2e2c2a9 Mon Sep 17 00:00:00 2001
From: Paul Frazee <pfrazee@gmail.com>
Date: Fri, 14 Oct 2016 18:04:33 -0500
Subject: [PATCH] fixes and tests for webview 'webpreferences' attr

---
 lib/browser/guest-view-manager.js            |  5 ++--
 lib/renderer/web-view/web-view-attributes.js |  2 +-
 spec/webview-spec.js                         | 27 ++++++++++++++++++++
 3 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/lib/browser/guest-view-manager.js b/lib/browser/guest-view-manager.js
index b62e7cf2bf4..c4b0022f67a 100644
--- a/lib/browser/guest-view-manager.js
+++ b/lib/browser/guest-view-manager.js
@@ -188,6 +188,7 @@ const attachGuest = function (embedder, elementInstanceId, guestInstanceId, para
   // this uses the same parsing rules as window.open uses for its features
   if (typeof params.webpreferences === 'string') {
     // split the attribute's value by ','
+    let i, len
     let webpreferencesTokens = params.webpreferences.split(/,\s*/)
     for (i = 0, len = webpreferencesTokens.length; i < len; i++) {
       // expected form is either a name by itself (true boolean flag)
@@ -195,8 +196,8 @@ const attachGuest = function (embedder, elementInstanceId, guestInstanceId, para
       // split the tokens by '='
       let pref = webpreferencesTokens[i]
       let prefTokens = pref.split(/\s*=/)
-      name = prefTokens[0]
-      value = prefTokens[1]
+      let name = prefTokens[0]
+      let value = prefTokens[1]
       if (!name) continue
 
       // interpret the value as a boolean, if possible 
diff --git a/lib/renderer/web-view/web-view-attributes.js b/lib/renderer/web-view/web-view-attributes.js
index 7c5cf81e4b6..f87fca31223 100644
--- a/lib/renderer/web-view/web-view-attributes.js
+++ b/lib/renderer/web-view/web-view-attributes.js
@@ -335,7 +335,7 @@ WebViewImpl.prototype.setupWebViewAttributes = function () {
   this.attributes[webViewConstants.ATTRIBUTE_BLINKFEATURES] = new BlinkFeaturesAttribute(this)
   this.attributes[webViewConstants.ATTRIBUTE_DISABLEBLINKFEATURES] = new DisableBlinkFeaturesAttribute(this)
   this.attributes[webViewConstants.ATTRIBUTE_GUESTINSTANCE] = new GuestInstanceAttribute(this)
-  this.attributes[webviewConstants.ATTRIBUTE_WEBPREFERENCES] = new WebPreferencesAttribute(this)
+  this.attributes[webViewConstants.ATTRIBUTE_WEBPREFERENCES] = new WebPreferencesAttribute(this)
 
   const autosizeAttributes = [webViewConstants.ATTRIBUTE_MAXHEIGHT, webViewConstants.ATTRIBUTE_MAXWIDTH, webViewConstants.ATTRIBUTE_MINHEIGHT, webViewConstants.ATTRIBUTE_MINWIDTH]
   autosizeAttributes.forEach((attribute) => {
diff --git a/spec/webview-spec.js b/spec/webview-spec.js
index 1c49688adeb..059fc722888 100644
--- a/spec/webview-spec.js
+++ b/spec/webview-spec.js
@@ -406,6 +406,33 @@ describe('<webview> tag', function () {
     })
   })
 
+  describe('webpreferences attribute', function () {
+    it('can enable nodeintegration', function (done) {
+      webview.addEventListener('console-message', function (e) {
+        assert.equal(e.message, 'function object object')
+        done()
+      })
+      webview.setAttribute('webpreferences', 'nodeIntegration')
+      webview.src = 'file://' + fixtures + '/pages/d.html'
+      document.body.appendChild(webview)
+    })
+
+    it('can disables web security and enable nodeintegration', function (done) {
+      var jqueryPath = path.join(__dirname, '/static/jquery-2.0.3.min.js')
+      var src = `<script src='file://${jqueryPath}'></script> <script>console.log('ok '+(typeof require));</script>`
+      var encoded = btoa(unescape(encodeURIComponent(src)))
+      var listener = function (e) {
+        assert.equal(e.message, 'ok function')
+        webview.removeEventListener('console-message', listener)
+        done()
+      }
+      webview.addEventListener('console-message', listener)
+      webview.setAttribute('webpreferences', 'webSecurity=no, nodeIntegration=yes')
+      webview.src = 'data:text/html;base64,' + encoded
+      document.body.appendChild(webview)
+    })
+  })
+
   describe('new-window event', function () {
     if (process.env.TRAVIS === 'true' && process.platform === 'darwin') {
       return