Bug 1195735, r=zer0

addon-sdk/source/lib/sdk/panel.js

@@ -26,6 +26,7 @@ const { contract } = require("./util/contract");
 const { on, off, emit, setListeners } = require("./event/core");
 const { EventTarget } = require("./event/target");
 const domPanel = require("./panel/utils");
+const { getDocShell } = require('./frame/utils');
 const { events } = require("./panel/events");
 const systemEvents = require("./system/events");
 const { filter, pipe, stripListeners } = require("./event/utils");
@@ -73,9 +74,26 @@ var panelContract = contract(merge({
   contentStyleFile: merge(Object.create(loaderContract.rules.contentScriptFile), {
     msg: 'The `contentStyleFile` option must be a local URL or an array of URLs'
   }),
-  contextMenu: boolean
+  contextMenu: boolean,
+  allow: {
+    is: ['object', 'undefined', 'null'],
+    map: function (allow) { return { script: !allow || allow.script !== false }}
+  },
 }, displayContract.rules, loaderContract.rules));
 
+function Allow(panel) {
+  return {
+    get script() { return getDocShell(viewFor(panel).backgroundFrame).allowJavascript; },
+    set script(value) { return setScriptState(panel, value); },
+  };
+}
+
+function setScriptState(panel, value) {
+  let view = viewFor(panel);
+  getDocShell(view.backgroundFrame).allowJavascript = value;
+  getDocShell(view.viewFrame).allowJavascript = value;
+  view.setAttribute("sdkscriptenabled", "" + value);
+}
 
 function isDisposed(panel) !views.has(panel);
 
@@ -147,7 +165,8 @@ const Panel = Class({
     }
 
     // Setup view
-    let view = domPanel.make();
+    let viewOptions = {allowJavascript: !model.allow || (model.allow.script !== false)};
+    let view = domPanel.make(null, viewOptions);
     panels.set(view, this);
     views.set(this, view);
 
@@ -212,6 +231,12 @@ const Panel = Class({
     workerFor(this).detach();
   },
 
+  get allow() { return Allow(this); },
+  set allow(value) {
+    let allowJavascript = panelContract({ allow: value }).allow.script;
+    return setScriptState(this, value);
+  },
+
   /* Public API: Panel.isShowing */
   get isShowing() !isDisposed(this) && domPanel.isOpen(viewFor(this)),
 

addon-sdk/source/lib/sdk/panel/utils.js

@@ -14,7 +14,7 @@ const { platform } = require("../system");
 const { getMostRecentBrowserWindow, getOwnerBrowserWindow,
         getHiddenWindow, getScreenPixelsPerCSSPixel } = require("../window/utils");
 
-const { create: createFrame, swapFrameLoaders } = require("../frame/utils");
+const { create: createFrame, swapFrameLoaders, getDocShell } = require("../frame/utils");
 const { window: addonWindow } = require("../addon/window");
 const { isNil } = require("../lang/type");
 const { data } = require('../self');
@@ -247,10 +247,11 @@ function setupPanelFrame(frame) {
   }
 }
 
-function make(document) {
+function make(document, options) {
   document = document || getMostRecentBrowserWindow().document;
   let panel = document.createElementNS(XUL_NS, "panel");
   panel.setAttribute("type", "arrow");
+  panel.setAttribute("sdkscriptenabled", "" + options.allowJavascript);
 
   // Note that panel is a parent of `viewFrame` who's `docShell` will be
   // configured at creation time. If `panel` and there for `viewFrame` won't
@@ -259,7 +260,7 @@ function make(document) {
   attach(panel, document);
 
   let frameOptions =  {
-    allowJavascript: true,
+    allowJavascript: options.allowJavascript,
     allowPlugins: true,
     allowAuth: true,
     allowWindowControl: false,
@@ -284,8 +285,16 @@ function make(document) {
     // See Bug 886329
     if (target !== this) return;
 
-    try { swapFrameLoaders(backgroundFrame, viewFrame); }
-    catch(error) { console.exception(error); }
+    try {
+      swapFrameLoaders(backgroundFrame, viewFrame);
+      // We need to re-set this because... swapFrameLoaders. Or something.
+      let shouldEnableScript = panel.getAttribute("sdkscriptenabled") == "true";
+      getDocShell(backgroundFrame).allowJavascript = shouldEnableScript;
+      getDocShell(viewFrame).allowJavascript = shouldEnableScript;
+    }
+    catch(error) {
+      console.exception(error);
+    }
     events.emit(type, { subject: panel });
   }
 
@@ -331,6 +340,7 @@ function make(document) {
 
 
   panel.backgroundFrame = backgroundFrame;
+  panel.viewFrame = viewFrame;
 
   // Store event listener on the panel instance so that it won't be GC-ed
   // while panel is alive.
@@ -356,8 +366,10 @@ function detach(panel) {
 exports.detach = detach;
 
 function dispose(panel) {
-  panel.backgroundFrame.parentNode.removeChild(panel.backgroundFrame);
+  panel.backgroundFrame.remove();
+  panel.viewFrame.remove();
   panel.backgroundFrame = null;
+  panel.viewFrame = null;
   events.off("document-element-inserted", panel.onContentChange);
   panel.onContentChange = null;
   detach(panel);