1 files changed, 39 insertions, 0 deletions
diff --git a/layout/style/test/test_non_content_accessible_env_vars.html b/layout/style/test/test_non_content_accessible_env_vars.html
new file mode 100644
index 0000000000..d9714216b7
--- /dev/null
+++ b/layout/style/test/test_non_content_accessible_env_vars.html
@@ -0,0 +1,39 @@
+<!doctype html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<iframe></iframe>
+<iframe srcdoc="Foo"></iframe>
+<script>
+const NON_CONTENT_ACCESSIBLE_ENV_VARS = [
+  "-moz-gtk-csd-titlebar-radius",
+  "-moz-gtk-csd-minimize-button-position",
+  "-moz-gtk-csd-maximize-button-position",
+  "-moz-gtk-csd-close-button-position",
+  "-moz-content-preferred-color-scheme",
+  "-moz-overlay-scrollbar-fade-duration",
+  "scrollbar-inline-size",
+];
+
+function testInWin(win) {
+  let doc = win.document;
+  const div = doc.createElement("div");
+  doc.documentElement.appendChild(div);
+  for (const envVar of NON_CONTENT_ACCESSIBLE_ENV_VARS) {
+    div.style.setProperty("--foo", `env(${envVar},FALLBACK_VALUE)`);
+
+    assert_equals(
+      win.getComputedStyle(div).getPropertyValue("--foo"),
+      "FALLBACK_VALUE",
+      `${envVar} shouldn't be exposed to content in ${doc.documentURI}`
+    );
+  }
+}
+
+let t = async_test("Test non-content-accessible env() vars");
+onload = t.step_func_done(function() {
+  testInWin(window);
+  for (let f of document.querySelectorAll("iframe")) {
+    testInWin(f.contentWindow);
+  }
+});
+</script>