<!DOCTYPE html>
<html>
<body>
<script src="../../resources/js-test-pre.js"></script>
<div id="container">
<button id="copy" onclick="runTest()">1. Copy</button>
<div><br></div>
<div id="source" oncopy="doCopy(event)" contenteditable>
    <b>16th President of the United States:</b>
    <!-- secret-->
    <img src="../resources/abe.png" alt="Abraham Lincoln" onmouseover="dangerousCode()">
    <script>function dangerousCode() { } dangerousCode();</script>
</div>
<div id="destination" onpaste="doPaste(event)" contenteditable>3. Paste here</div></div>
<script>

description('This tests getData strips away secrets and dangerous code when copying inside a null origin document.');
jsTestIsAsync = true;

if (window.internals)
    internals.settings.setCustomPasteboardDataEnabled(true);

function runTest() {
    document.getElementById('source').focus();
    document.execCommand('selectAll');
    document.execCommand('copy');
}

const container = document.getElementById('container');
function doCopy(event) {
    const iframe = document.createElement('iframe');
    container.insertBefore(iframe, container.lastChild);
    iframe.src = `data:text/html;charset=utf-8,<!DOCTYPE html>
    <div id="destination" onpaste="doPaste(event)" contenteditable>2. Paste here</div>
    <script>

    function doPaste(event) {
        event.preventDefault();
        parent.postMessage({
            html: event.clipboardData.getData('text/html'),
            types: event.clipboardData.types,
            items: Array.from(event.clipboardData.items).map((item) => ({kind: item.kind, type: item.type})),
        }, '*');
    };

    document.getElementById('destination').focus();
    if (window.testRunner)
        document.execCommand('paste');

    </scri` + 'pt>';
}

onmessage = (event) => {
    typesInNullOrigin = event.data.types;
    shouldBeTrue('typesInNullOrigin.includes("text/html")');

    htmlInNullOrigin = event.data.html;
    shouldBeFalse('htmlInNullOrigin.includes("secret")');
    shouldBeFalse('htmlInNullOrigin.includes("dangerousCode")');
    shouldBeTrue('parsedTree = (new DOMParser).parseFromString(htmlInNullOrigin, "text/html"); !!parsedTree.querySelector("b");');
    shouldBeEqualToString('parsedTree.querySelector("b").textContent', '16th President of the United States:');
    shouldBeEqualToString('(new URL(parsedTree.querySelector("img").src)).protocol', 'blob:');
    shouldBeFalse('parsedTree.querySelector("img").src.includes("resources/abe.png")');

    itemsInNullOrigin = event.data.items;
    shouldBeTrue('itemsInNullOrigin.some((item) => item.kind == "string" && item.type == "text/html")');

    document.getElementById('destination').focus();
    if (window.testRunner)
        document.execCommand('paste');
}

function doPaste(event) {
    event.preventDefault();

    typesInSameDocument = event.clipboardData.types;
    shouldBeTrue('typesInNullOrigin.includes("text/html")');

    htmlInSameDocument = event.clipboardData.getData('text/html');
    shouldBeFalse('htmlInSameDocument.includes("secret")');
    shouldBeFalse('htmlInSameDocument.includes("dangerousCode")');
    shouldBeTrue('parsedTree = (new DOMParser).parseFromString(htmlInNullOrigin, "text/html"); !!parsedTree.querySelector("b");');
    shouldBeEqualToString('parsedTree.querySelector("b").textContent', '16th President of the United States:');

    // FIXME: These two test cases fail.
    shouldBeEqualToString('(new URL(parsedTree.querySelector("img").src)).protocol', 'file:');
    shouldBeTrue('parsedTree.querySelector("img").src.includes("resources/abe.png")');

    itemsInSameDocument = Array.from(event.clipboardData.items);
    shouldBeTrue('itemsInSameDocument.some((item) => item.kind == "string" && item.type == "text/html")');

    container.remove();
    finishJSTest();
}

if (window.testRunner)
    window.onload = runTest;

successfullyParsed = true;

</script>
<script src="../../resources/js-test-post.js"></script>
</body>
</html>