Add assertion to confirm Node.js is disabled in rederer by executing require()

test/modules/environment.js

@@ -35,6 +35,27 @@ module.exports = {
     chaiAsPromised.transferPromiseness = app.transferPromiseness
     return app;
   },
+
+  addClientCommands: function(client) {
+    client.addCommand('loadSettingsPage', function async() {
+      return this
+        .url('file://' + path.join(source_root_dir, 'dist/browser/settings.html'))
+        .waitUntilWindowLoaded();
+    });
+    client.addCommand('isNodeEnabled', function async() {
+      return this.execute(function() {
+        try {
+          return require('child_process') ? true : false;
+        }
+        catch (e) {
+          return false;
+        }
+      }).then((require_result) => {
+        return require_result.value;
+      });
+    });
+  },
+
   // execute the test only when `condition` is true
   shouldTest: function(it, condition) {
     return condition ? it : it.skip;

test/specs/browser/settings_test.js

@@ -5,14 +5,6 @@ const fs = require('fs');
 
 const env = require('../../modules/environment');
 
-function addClientCommands(client) {
-  client.addCommand('loadSettingsPage', function() {
-    return this
-      .url('file://' + path.join(env.sourceRootDir, 'dist/browser/settings.html'))
-      .waitUntilWindowLoaded();
-  });
-}
-
 describe('browser/settings.html', function() {
   this.timeout(10000);
 
@@ -40,7 +32,7 @@ describe('browser/settings.html', function() {
   });
 
   it('should show index.thml when Cancel button is clicked', function() {
-    addClientCommands(this.app.client);
+    env.addClientCommands(this.app.client);
     return this.app.client
       .loadSettingsPage()
       .click('#btnCancel')
@@ -49,7 +41,7 @@ describe('browser/settings.html', function() {
   });
 
   it('should show index.thml when Save button is clicked', function() {
-    addClientCommands(this.app.client);
+    env.addClientCommands(this.app.client);
     return this.app.client
       .loadSettingsPage()
       .click('#btnSave')
@@ -61,7 +53,7 @@ describe('browser/settings.html', function() {
     describe('Hide Menu Bar', function() {
       it('should appear on win32 or linux', function() {
         const expected = (process.platform === 'win32' || process.platform === 'linux');
-        addClientCommands(this.app.client);
+        env.addClientCommands(this.app.client);
         return this.app.client
           .loadSettingsPage()
           .isExisting('#inputHideMenuBar').should.eventually.equal(expected)
@@ -70,7 +62,7 @@ describe('browser/settings.html', function() {
       [true, false].forEach(function(v) {
         env.shouldTest(it, env.isOneOf(['win32', 'linux']))
           (`should be saved and loaded: ${v}`, function() {
-            addClientCommands(this.app.client);
+            env.addClientCommands(this.app.client);
             return this.app.client
               .loadSettingsPage()
               .isSelected('#inputHideMenuBar input').then((isSelected) => {
@@ -87,7 +79,7 @@ describe('browser/settings.html', function() {
               .browserWindow.isMenuBarAutoHide().should.eventually.equal(v).then(() => {
                 return this.app.restart();
               }).then(() => {
-                addClientCommands(this.app.client);
+                env.addClientCommands(this.app.client);
                 return this.app.client
                   // confirm actual behavior
                   .browserWindow.isMenuBarAutoHide().should.eventually.equal(v)
@@ -101,7 +93,7 @@ describe('browser/settings.html', function() {
     describe('Allow mixed content', function() {
       [true, false].forEach(function(v) {
         it(`should be saved and loaded: ${v}`, function() {
-          addClientCommands(this.app.client);
+          env.addClientCommands(this.app.client);
           return this.app.client
             .loadSettingsPage()
             .isSelected('#inputDisableWebSecurity input').then((isSelected) => {
@@ -123,7 +115,7 @@ describe('browser/settings.html', function() {
             }).then(() => {
               return this.app.restart();
             }).then(() => {
-              addClientCommands(this.app.client);
+              env.addClientCommands(this.app.client);
               return this.app.client
                 // confirm actual behavior
                 .getAttribute('.mattermostView', 'disablewebsecurity').then((disablewebsecurity) => {
@@ -142,7 +134,7 @@ describe('browser/settings.html', function() {
     describe('Start app on login', function() {
       it('should appear on win32 or linux', function() {
         const expected = (process.platform === 'win32' || process.platform === 'linux');
-        addClientCommands(this.app.client);
+        env.addClientCommands(this.app.client);
         return this.app.client
           .loadSettingsPage()
           .isExisting('#inputAutoStart').should.eventually.equal(expected)
@@ -152,7 +144,7 @@ describe('browser/settings.html', function() {
     describe('Show tray icon', function() {
       it('should appear on darwin or linux', function() {
         const expected = (process.platform === 'darwin' || process.platform === 'linux');
-        addClientCommands(this.app.client);
+        env.addClientCommands(this.app.client);
         return this.app.client
           .loadSettingsPage()
           .isExisting('#inputShowTrayIcon').should.eventually.equal(expected)
@@ -162,7 +154,7 @@ describe('browser/settings.html', function() {
     describe('Notifications', function() {
       it('should appear on win32', function() {
         const expected = (process.platform === 'win32');
-        addClientCommands(this.app.client);
+        env.addClientCommands(this.app.client);
         return this.app.client
           .loadSettingsPage()
           .isExisting('#notificationsRow').should.eventually.equal(expected)

test/specs/security_test.js

@@ -7,16 +7,19 @@ const http = require('http');
 const env = require('../modules/environment');
 
 describe('application', function() {
+  this.timeout(10000);
+
   const serverPort = 8181;
+  const testURL = `http://localhost:${serverPort}`
 
   const config = {
     version: 1,
     teams: [{
       name: 'example_1',
-      url: `http://localhost:${serverPort}`
+      url: testURL
     }, {
       name: 'example_2',
-      url: `http://localhost:${serverPort}`
+      url: testURL
     }]
   };
 
@@ -46,32 +49,27 @@ describe('application', function() {
   })
 
   it('should NOT be able to call Node.js API in webview', function() {
+    env.addClientCommands(this.app.client);
     return this.app.client
-      // Ideally, need to confirm actual behavior in webview by executing require('electron');
       .getAttribute('webview', 'nodeintegration').then((nodeintegration) => {
         // nodeintegration is an array of string
         nodeintegration.forEach((n) => {
           n.should.equal('false');
         });
-      });
+      })
+      // webview is handled as a window by chromedriver.
+      .windowByIndex(1).isNodeEnabled().should.eventually.be.false
+      .windowByIndex(2).isNodeEnabled().should.eventually.be.false;
   });
 
   it('should NOT be able to call Node.js API in a new window', function() {
+    env.addClientCommands(this.app.client);
     return this.app.client
       .execute(function() {
         const webview = document.querySelector('webview');
         webview.executeJavaScript('open_window();');
       })
-      .windowByIndex(1)
+      .pause(500) // wait for the new window
-      .execute(function() {
+      .windowByIndex(3).isNodeEnabled().should.eventually.be.false;
-        try {
-          return require('fs') ? true : false;
-        }
-        catch (e) {
-          return false;
-        }
-      }).then((require_fs_result) => {
-        require_fs_result.value.should.be.false;
-      });
   })
 });