<!DOCTYPE html>
<html>
<body>
<script src="../../resources/js-test-pre.js"></script>
<div id="container">
<button id="copy" onclick="runTest()">1. Copy</button>
<div><br></div>
<div id="source" oncopy="doCopy(event)" contenteditable>some text</div>
<div id="destination" onpaste="doPaste(event)" contenteditable>3. Paste here</div>
</div>
<script>

description('This tests getData strips away secrets and dangerous code when copying inside a null origin document.');
jsTestIsAsync = true;

if (window.internals)
    internals.settings.setCustomPasteboardDataEnabled(true);

function runTest() {
    document.getElementById('source').focus();
    document.execCommand('selectAll');
    document.execCommand('copy');
}

var originalHTML = '<meta content="secret"><b onmouseover="dangerousCode()">hello</b><!-- secret-->, world<script>dangerousCode()</scr' + 'ipt>';
function doCopy(event) {
    event.clipboardData.setData('text/html', originalHTML);
    event.preventDefault();

    const iframe = document.createElement('iframe');
    document.getElementById('container').insertBefore(iframe, iframe.lastChild);
    iframe.src = `data:text/html;charset=utf-8,<!DOCTYPE html>
    <div id="destination" onpaste="doPaste(event)" contenteditable>2. Paste here</div>
    <script>

    function doPaste(event) {
        event.preventDefault();
        parent.postMessage({
            html: event.clipboardData.getData('text/html'),
            types: event.clipboardData.types,
            items: Array.from(event.clipboardData.items).map((item) => ({kind: item.kind, type: item.type})),
        }, '*');
    };

    document.getElementById('destination').focus();
    if (window.testRunner)
        document.execCommand('paste');

    </scri` + 'pt>';
}

onmessage = (event) => {
    typesInNullOrigin = event.data.types;
    shouldBeEqualToString('JSON.stringify(typesInNullOrigin)', '["text/html"]');

    htmlInNullOrigin = event.data.html;
    shouldBeFalse('htmlInNullOrigin.includes("secret")');
    shouldBeFalse('htmlInNullOrigin.includes("dangerousCode")');
    shouldBeEqualToString('b = (new DOMParser).parseFromString(htmlInNullOrigin, "text/html").querySelector("b"); b.textContent', 'hello');
    shouldBeEqualToString('b.parentNode.textContent', 'hello, world');

    itemsInNullOrigin = event.data.items;
    shouldBeEqualToString('JSON.stringify(itemsInNullOrigin)', '[{"kind":"string","type":"text/html"}]');
    document.getElementById('destination').focus();
    if (window.testRunner)
        document.execCommand('paste');
}

function doPaste(event) {
    shouldBeEqualToString('event.clipboardData.getData("text/html")', originalHTML);
    shouldBeEqualToString('JSON.stringify(event.clipboardData.types)', '["text/html"]');
    shouldBeEqualToString('JSON.stringify(Array.from(event.clipboardData.items).map((item) => ({kind: item.kind, type: item.type})))',
        '[{"kind":"string","type":"text/html"}]');
    document.getElementById('container').remove();
    finishJSTest();
}

if (window.testRunner)
    window.onload = runTest;

successfullyParsed = true;

</script>
<script src="../../resources/js-test-post.js"></script>
</body>
</html>