Properly inherit "document features" configuration into iframes

The whole "document features" setup is legacy stuff from old API, but it is used to implement the important runScripts and resources options in the new API. Fixes #1821.
jsdom · Apr 29, 2017 · 3d0f28d · 3d0f28d
1 parent 1f488ec
commit 3d0f28d
Show file tree

Hide file tree

Showing 4 changed files with 15 additions and 9 deletions.
diff --git a/lib/jsdom/browser/documentfeatures.js b/lib/jsdom/browser/documentfeatures.js
@@ -12,9 +12,7 @@ exports.defaultDocumentFeatures = {
   SkipExternalResources: false
 };
 
-exports.applyDocumentFeatures = (documentImpl, features) => {
-  features = features || {};
-
+exports.applyDocumentFeatures = (documentImpl, features = {}) => {
   for (let i = 0; i < exports.availableDocumentFeatures.length; ++i) {
     const featureName = exports.availableDocumentFeatures[i];
     let featureSource;

diff --git a/lib/jsdom/living/nodes/DOMImplementation-impl.js b/lib/jsdom/living/nodes/DOMImplementation-impl.js
@@ -146,6 +146,8 @@ class DOMImplementationImpl {
         this._ownerDocument._defaultView._globalProxy = vm.runInContext("this", this._ownerDocument._global);
         this._ownerDocument._defaultView = this._ownerDocument._defaultView._globalProxy;
       }
+    } else {
+      this._features[feature] = [];
     }
   }
 

diff --git a/lib/jsdom/living/nodes/Document-impl.js b/lib/jsdom/living/nodes/Document-impl.js
@@ -282,12 +282,6 @@ class DocumentImpl extends NodeImpl {
     this.readyState = "loading";
 
     this._lastFocusedElement = null;
-
-    // Add level2 features
-    this.implementation._addFeature("core", "2.0");
-    this.implementation._addFeature("html", "2.0");
-    this.implementation._addFeature("xhtml", "2.0");
-    this.implementation._addFeature("xml", "2.0");
   }
 
   _defaultElementBuilder(document, tagName) {

diff --git a/test/api/options.js b/test/api/options.js
@@ -188,6 +188,18 @@ describe("API: constructor options", () => {
       assert.strictEqual(dom.window.eval, undefined);
     });
 
+    it("should not execute any scripts, even in iframes, by default (GH-1821)", () => {
+      const dom = new JSDOM(`<iframe></iframe>`);
+      const frameWindow = dom.window.document.querySelector("iframe").contentWindow;
+
+      frameWindow.document.open();
+      frameWindow.document.write(`<script>parent.prop = "i was executed";</script>`);
+      frameWindow.document.close();
+
+      assert.strictEqual(dom.window.prop, undefined);
+      assert.strictEqual(frameWindow.eval, undefined);
+    });
+
     it("should execute <script>s and eval when set to \"dangerously\"", () => {
       const dom = new JSDOM(`<body>
         <script>document.body.appendChild(document.createElement("hr"));</script>