<!DOCTYPE html>
<html>
<body>
<script src="/resources/js-test-pre.js"></script>
<p id="description"></p>
<div id="console"></div>
<div id="container">
<button onclick="runTest()">Copy</button>
<div><br></div>
<div id="source" contenteditable>
    hello, <meta content="some secret"><!-- secret -->
    <img onclick="dangerousCode()" src="resources/apple.gif"><br>
    <iframe src="http://localhost:8000/security/clipboard/resources/content-to-copy.html"></iframe>
</div>
<div id="destination" onpaste="doPaste(event)" contenteditable>Paste here</div>
</div>
<script>

description('This tests copying and pasting HTML by the default action. WebKit should not sanitize the HTML in the same document.');
jsTestIsAsync = true;

if (window.internals)
    internals.settings.setCustomPasteboardDataEnabled(true);

function runTest() {
    document.getElementById('source').focus();
    document.execCommand('selectAll');
    document.execCommand('copy');
    setTimeout(() => {
        document.getElementById('destination').focus();
        document.execCommand('selectAll');
        if (window.testRunner)
            document.execCommand('paste');
    }, 0);
}

function doPaste(event) {
    shouldBeTrue('html = event.clipboardData.getData("text/html"); html.includes("hello")');
    shouldBeTrue('destination.innerHTML = html; img = destination.querySelector("img"); !!img');
    shouldBeEqualToString('new URL(img.src).protocol', 'http:');
    shouldBeTrue('html.includes("http://localhost:8000/security/clipboard/resources/content-to-copy.html")');
    shouldBeFalse('html.includes("secret")');
    evalAndLog('destination.innerHTML = ""');

    const observer = new MutationObserver((recordList) => {
        for (const record of recordList) {
            for (const node of record.addedNodes) {
                if (node.nodeValue === null)
                    continue;
                if (node.nodeValue.includes('secret'))
                    testFailed(`Saw secret in a node ${node}`);
                if (node.nodeValue.includes('dangerousCode'))
                    testFailed(`Saw dangerous code in a node ${node}`);
            }
        }
    });
    observer.observe(destination, {childList: true, subtree: true});

    window.onmessage = checkFrameAccess;
}

function checkFrameAccess() {
    shouldBeTrue('destination.textContent.includes("hello")');
    shouldBeFalse('destination.innerHTML.includes("secret")');
    shouldBeFalse('destination.innerHTML.includes("dangerousCode")');
    shouldBeTrue('destination.querySelector("img"); !!img');
    shouldBeEqualToString('new URL(img.src).protocol', 'http:');
    shouldBeNull('source.querySelector("iframe").contentDocument');
    shouldBeNull('destination.querySelector("iframe").contentDocument');
    container.remove();
    finishJSTest();
}

if (window.testRunner)
    window.onload = runTest;

var successfullyParsed = true;

</script>
<script src="/resources/js-test-post.js"></script>
</body>
</html>