gecko-dev/dom/security/test/csp/file_evalscript_main_allowed.js

// some javascript for the CSP eval() tests
// all of these evals should succeed, as the document loading this script
// has script-src 'self' 'unsafe-eval'

function logResult(str, passed) {
  var elt = document.createElement("div");
  var color = passed ? "#cfc;" : "#fcc";
  elt.setAttribute(
    "style",
    "background-color:" +
      color +
      "; width:100%; border:1px solid black; padding:3px; margin:4px;"
  );
  elt.innerHTML = str;
  document.body.appendChild(elt);
}

// callback for when stuff is allowed by CSP
var onevalexecuted = (function(window) {
  return function(shouldrun, what, data) {
    window.parent.scriptRan(shouldrun, what, data);
    logResult(
      (shouldrun ? "PASS: " : "FAIL: ") + what + " : " + data,
      shouldrun
    );
  };
})(window);

// callback for when stuff is blocked
var onevalblocked = (function(window) {
  return function(shouldrun, what, data) {
    window.parent.scriptBlocked(shouldrun, what, data);
    logResult(
      (shouldrun ? "FAIL: " : "PASS: ") + what + " : " + data,
      !shouldrun
    );
  };
})(window);

// Defer until document is loaded so that we can write the pretty result boxes
// out.
addEventListener(
  "load",
  function() {
    // setTimeout(String) test  -- should pass
    try {
      setTimeout(
        'onevalexecuted(true, "setTimeout(String)", "setTimeout with a string was enabled.");',
        10
      );
    } catch (e) {
      onevalblocked(
        true,
        "setTimeout(String)",
        "setTimeout with a string was blocked"
      );
    }

    // setTimeout(function) test  -- should pass
    try {
      setTimeout(function() {
        onevalexecuted(
          true,
          "setTimeout(function)",
          "setTimeout with a function was enabled."
        );
      }, 10);
    } catch (e) {
      onevalblocked(
        true,
        "setTimeout(function)",
        "setTimeout with a function was blocked"
      );
    }

    // eval() test
    try {
      eval('onevalexecuted(true, "eval(String)", "eval() was enabled.");');
    } catch (e) {
      onevalblocked(true, "eval(String)", "eval() was blocked");
    }

    // eval(foo,bar) test
    try {
      eval(
        'onevalexecuted(true, "eval(String,scope)", "eval() was enabled.");',
        1
      );
    } catch (e) {
      onevalblocked(
        true,
        "eval(String,object)",
        "eval() with scope was blocked"
      );
    }

    // [foo,bar].sort(eval) test
    try {
      [
        'onevalexecuted(true, "[String, obj].sort(eval)", "eval() was enabled.");',
        1,
      ].sort(eval);
    } catch (e) {
      onevalblocked(
        true,
        "[String, obj].sort(eval)",
        "eval() with scope via sort was blocked"
      );
    }

    // [].sort.call([foo,bar], eval) test
    try {
      [].sort.call(
        [
          'onevalexecuted(true, "[String, obj].sort(eval)", "eval() was enabled.");',
          1,
        ],
        eval
      );
    } catch (e) {
      onevalblocked(
        true,
        "[].sort.call([String, obj], eval)",
        "eval() with scope via sort/call was blocked"
      );
    }

    // new Function() test
    try {
      var fcn = new Function(
        'onevalexecuted(true, "new Function(String)", "new Function(String) was enabled.");'
      );
      fcn();
    } catch (e) {
      onevalblocked(
        true,
        "new Function(String)",
        "new Function(String) was blocked."
      );
    }

    // ShadowRealm.prototype.evaluate
    try {
      var sr = new ShadowRealm();
      sr.evaluate("var x = 10");
      onevalexecuted(
        true,
        "ShadowRealm.prototype.evaluate(String)",
        "ShadowRealm.prototype.evaluate(String) was enabled."
      );
    } catch (e) {
      onevalblocked(
        true,
        "ShadowRealm.prototype.evaluate(String)",
        "ShadowRealm.prototype.evaluate(String) was blocked."
      );
    }

    function checkResult() {
      //alert(bar);
      if (bar) {
        onevalexecuted(
          true,
          "setTimeout(eval, 0, str)",
          "setTimeout(eval, 0, string) was enabled."
        );
      } else {
        onevalblocked(
          true,
          "setTimeout(eval, 0, str)",
          "setTimeout(eval, 0, str) was blocked."
        );
      }
    }

    var bar = false;

    function foo() {
      bar = true;
    }

    window.foo = foo;

    // setTimeout(eval, 0, str)

    // error is not catchable here

    setTimeout(eval, 0, "window.foo();");

    setTimeout(checkResult.bind(this), 0);
  },
  false
);