6 files changed, 54 insertions, 15 deletions
diff --git a/chrome/browser/resources/downloads.html b/chrome/browser/resources/downloads.html
index 7cf0a5d..4fe34dd 100644
--- a/chrome/browser/resources/downloads.html
+++ b/chrome/browser/resources/downloads.html
@@ -2,6 +2,11 @@
 <html i18n-values="dir:textdirection;">
 <head>
 <meta charset="utf-8">
+<!-- X-WebKit-CSP is our development name for Content-Security-Policy.
+     TODO(tsepez) rename when Content-security-policy is done.
+     TODO(tsepez) remove unsafe-eval when bidichecker_packaged.js fixed.
+-->
+<meta http-equiv="X-WebKit-CSP" content="object-src 'none'; script-src chrome://resources 'self' 'unsafe-eval'">
 <title i18n-content="title"></title>
 <link rel="icon" href="../../app/theme/downloads_favicon.png">
 <style>
@@ -179,16 +184,13 @@ html[dir=rtl] .progress {
 
 </style>
 <script src="chrome://resources/js/local_strings.js"></script>
-<script src="chrome://downloads/downloads.js"></script>
 </head>
-<body onload="load();" i18n-values=".style.fontFamily:fontfamily;.style.fontSize:fontsize">
+<body i18n-values=".style.fontFamily:fontfamily;.style.fontSize:fontsize">
 <div class="header">
-  <a href="" onclick="setSearch(''); return false;">
+  <a id="search-link" href="">
     <img src="shared/images/downloads_section.png"
          width="67" height="67" class="logo" border="0" /></a>
-  <form method="post" action=""
-      onsubmit="setSearch(this.term.value); return false;"
-      class="form">
+  <form id="search-form" method="post" action="" class="form">
     <input type="text" name="term" id="term" />
     <input type="submit" name="submit" i18n-values="value:searchbutton" />
   </form>
@@ -196,12 +198,13 @@ html[dir=rtl] .progress {
 <div class="main">
   <div id="downloads-summary">
     <span id="downloads-summary-text" i18n-content="downloads">Downloads</span>
-    <a id="clear-all" href="" onclick="clearAll();" i18n-content="clear_all">Clear All</a>
+    <a id="clear-all" href="" i18n-content="clear_all">Clear All</a>
   </div>
   <div id="downloads-display"></div>
 </div>
 <div class="footer">
 </div>
+<script src="chrome://downloads/downloads.js"></script>
 <script src="chrome://downloads/strings.js"></script>
 <script src="chrome://resources/js/i18n_template.js"></script>
 <script src="chrome://resources/js/i18n_process.js"></script>
diff --git a/chrome/browser/resources/downloads.js b/chrome/browser/resources/downloads.js
index 8991ed7..ddfdb40 100644
--- a/chrome/browser/resources/downloads.js
+++ b/chrome/browser/resources/downloads.js
@@ -587,3 +587,15 @@ function downloadUpdated(results) {
   }
 }
 
+// Add handlers to HTML elements.
+document.body.onload = load;
+$('clear-all').onclick = function () { clearAll(''); };
+$('search-link').onclick = function () {
+  setSearch('');
+  return false;
+};
+$('search-form').onsubmit = function () {
+  setSearch(this.term.value);
+  return false;
+};
+
diff --git a/chrome/browser/resources/history.html b/chrome/browser/resources/history.html
index 97bff5e..b6d9b32 100644
--- a/chrome/browser/resources/history.html
+++ b/chrome/browser/resources/history.html
@@ -2,11 +2,15 @@
 <html i18n-values="dir:textdirection;">
 <head>
 <meta charset="utf-8">
+<!-- X-WebKit-CSP is our development name for Content-Security-Policy.
+     TODO(tsepez) rename when Content-security-policy is done.
+     TODO(tsepez) remove unsafe-eval when bidichecker_packaged.js fixed.
+-->
+<meta http-equiv="X-WebKit-CSP" content="object-src 'none'; script-src chrome://resources 'self' 'unsafe-eval'">
 <title i18n-content="title"></title>
 <link rel="icon" href="../../app/theme/history_favicon.png">
 <script src="chrome://resources/js/local_strings.js"></script>
 <script src="chrome://resources/js/util.js"></script>
-<script src="chrome://history/history.js"></script>
 <link rel="stylesheet" href="webui.css">
 <style>
 #results-separator {
@@ -119,16 +123,14 @@ html[dir='rtl'] .entry .title > a {
   padding-top:24px;
   -webkit-margin-start:18px;
 }
-
 </style>
 </head>
-<body onload="load();" i18n-values=".style.fontFamily:fontfamily;.style.fontSize:fontsize">
+<body i18n-values=".style.fontFamily:fontfamily;.style.fontSize:fontsize">
 <div class="header">
-  <a href="" onclick="setSearch(''); return false;">
+  <a id="history-section" href="">
     <img src="shared/images/history_section.png"
          width="67" height="67" class="logo" border="0"></a>
-  <form method="post" action=""
-      onsubmit="setSearch(this.term.value); return false;"
+  <form id="search-form" method="post" action=""
       class="form">
     <input type="text" name="term" id="term">
     <input type="submit" name="submit" i18n-values="value:searchbutton">
@@ -146,6 +148,7 @@ html[dir='rtl'] .entry .title > a {
 </div>
 <div class="footer">
 </div>
+<script src="chrome://history/history.js"></script>
 <script src="chrome://history/strings.js"></script>
 <script src="chrome://resources/js/i18n_template.js"></script>
 <script src="chrome://resources/js/i18n_process.js"></script>
diff --git a/chrome/browser/resources/history.js b/chrome/browser/resources/history.js
index ccfd6ec..c0a5287d 100644
--- a/chrome/browser/resources/history.js
+++ b/chrome/browser/resources/history.js
@@ -1037,3 +1037,14 @@ function deleteFailed() {
   setTimeout(deleteNextInQueue, 500);
 }
 
+// Add handlers to HTML elements.
+document.body.onload = load;
+$('history-section').onclick = function () {
+  setSearch('');
+  return false;
+};
+$('search-form').onsubmit = function () {
+  setSearch(this.term.value);
+  return false;
+}
+
diff --git a/chrome/browser/resources/options/options.html b/chrome/browser/resources/options/options.html
index a33e679..38caa07 100644
--- a/chrome/browser/resources/options/options.html
+++ b/chrome/browser/resources/options/options.html
@@ -2,6 +2,11 @@
 <html id="t" i18n-values="dir:textdirection">
 <head>
 <meta charset="utf-8">
+<!-- X-WebKit-CSP is our development name for Content-Security-Policy.
+     TODO(tsepez) rename when Content-security-policy is done.
+     TODO(tsepez) remove unsafe-eval when bidichecker_packaged.js fixed.
+-->
+<meta http-equiv="X-WebKit-CSP" content="object-src 'none'; script-src chrome://resources 'self' 'unsafe-eval'">
 <!-- Set the title to that of the default page so that the title doesn't flash
      on load (for the most common case). -->
 <title i18n-content="browserPageTabTitle"></title>
diff --git a/chrome/test/data/webui/test_api.js b/chrome/test/data/webui/test_api.js
index fc472d2..27d94f8 100644
--- a/chrome/test/data/webui/test_api.js
+++ b/chrome/test/data/webui/test_api.js
@@ -53,9 +53,14 @@
     throw new Error(message);
   }
 
-  function runTest(currentTest, testArguments) {
+  function runTest(testFunction, testArguments) {
     try {
-      currentTest = eval(currentTest);
+      // Avoid eval() if at all possible, since it will not work on pages
+      // that have enabled content-security-policy.
+      currentTest = this[testFunction];    // global object -- not a method.
+      if (typeof currentTest === "undefined") {
+        currentTest = eval(testFunction);
+      }
       console.log('Running test ' + currentTest.name);
       currentTest.apply(null, testArguments);
     } catch (e) {