Changeset 286988 in webkit

Timestamp:

Dec 13, 2021 3:31:19 PM (7 months ago)

Author:

commit-queue@webkit.org

Message:

A FormData constructed in the form's submit event listener shouldn't include the submitter
​https://bugs.webkit.org/show_bug.cgi?id=234069

Patch by Andreu Botella <​andreu@andreubotella.com> on 2021-12-13
Reviewed by Chris Dumez.

LayoutTests/imported/w3c:

• web-platform-tests/html/semantics/forms/form-submission-0/constructing-form-data-set-expected.txt:

Source/WebCore:

In the HTML spec, the "construct the entry list" algorithm takes an optional submitter
argument which it uses to determine whether a button should be included in the entry list.
The FormData constructor calls it with no optional arguments, so new FormData(form) should
never contain any buttons.

In WebKit, however, if a FormData object is constructed in the form's submit event
listener, it will contain the submitter button, if the form submission wasn't implicit. This
is because whether a form control is the submitter is tracked on the control, and activating
it sets that state for the duration of the form submission algorithm.

However, the form submission algorithm also sets a submitter's state, to deal with implicit
submissions. This is set only for the duration of the "construct the entry list" call, and
so there is no need to set the state when activating the button.

Tests: imported/w3c/web-platform-tests/html/semantics/forms/form-submission-0/constructing-form-data-set.html

• html/HTMLButtonElement.cpp:

(WebCore::HTMLButtonElement::defaultEventHandler):

• html/ImageInputType.cpp:

(WebCore::ImageInputType::handleDOMActivateEvent):

• html/SubmitInputType.cpp:

(WebCore::SubmitInputType::handleDOMActivateEvent):

Location:

trunk

Files:

• LayoutTests/imported/w3c/ChangeLog (modified) (1 diff)
• LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/form-submission-0/constructing-form-data-set-expected.txt (modified) (1 diff)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/html/HTMLButtonElement.cpp (modified) (1 diff)
• Source/WebCore/html/ImageInputType.cpp (modified) (2 diffs)
• Source/WebCore/html/SubmitInputType.cpp (modified) (1 diff)

trunk/LayoutTests/imported/w3c/ChangeLog

@@ +1 @@
+2021-12-13  Andreu Botella  <andreu@andreubotella.com>
+
+        A FormData constructed in the form's submit event listener shouldn't include the submitter
+        https://bugs.webkit.org/show_bug.cgi?id=234069
+
+        Reviewed by Chris Dumez.
+
+        * web-platform-tests/html/semantics/forms/form-submission-0/constructing-form-data-set-expected.txt:
+
 2021-12-13  Antti Koivisto  <antti@apple.com>
 

trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/form-submission-0/constructing-form-data-set-expected.txt

@@ -22 +22 @@
 PASS Entries added to "formData" IDL attribute should be submitted.
 PASS Entries added to the "formdata" IDL attribute shouldn't be newline normalized in the resulting FormData
-FAIL The constructed FormData object should not contain an entry for the submit button that was used to submit the form. assert_false: expected false got true
+PASS The constructed FormData object should not contain an entry for the submit button that was used to submit the form.
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-12-13  Andreu Botella  <andreu@andreubotella.com>
+
+        A FormData constructed in the form's submit event listener shouldn't include the submitter
+        https://bugs.webkit.org/show_bug.cgi?id=234069
+
+        Reviewed by Chris Dumez.
+
+        In the HTML spec, the "construct the entry list" algorithm takes an optional `submitter`
+        argument which it uses to determine whether a button should be included in the entry list.
+        The FormData constructor calls it with no optional arguments, so `new FormData(form)` should
+        never contain any buttons.
+
+        In WebKit, however, if a `FormData` object is constructed in the form's `submit` event
+        listener, it will contain the submitter button, if the form submission wasn't implicit. This
+        is because whether a form control is the submitter is tracked on the control, and activating
+        it sets that state for the duration of the form submission algorithm.
+
+        However, the form submission algorithm also sets a submitter's state, to deal with implicit
+        submissions. This is set only for the duration of the "construct the entry list" call, and
+        so there is no need to set the state when activating the button.
+
+        Tests: imported/w3c/web-platform-tests/html/semantics/forms/form-submission-0/constructing-form-data-set.html
+
+        * html/HTMLButtonElement.cpp:
+        (WebCore::HTMLButtonElement::defaultEventHandler):
+        * html/ImageInputType.cpp:
+        (WebCore::ImageInputType::handleDOMActivateEvent):
+        * html/SubmitInputType.cpp:
+        (WebCore::SubmitInputType::handleDOMActivateEvent):
+
 2021-12-13  Jean-Yves Avenard  <jya@apple.com>
 

trunk/Source/WebCore/html/HTMLButtonElement.cpp

@@ -147 +147 @@
             if (auto currentForm = form()) {
                 if (m_type == SUBMIT) {
-                    SetForScope<bool> activatedSubmitState(m_isActivatedSubmit, true);
                     currentForm->submitIfPossible(&event, this);
                 }

trunk/Source/WebCore/html/ImageInputType.cpp

@@ -88 +88 @@
     Ref<HTMLFormElement> protectedForm(*protectedElement->form());
 
-    protectedElement->setActivatedSubmit(true);
-
     m_clickLocation = IntPoint();
     if (event.underlyingEvent()) {
@@ -107 +105 @@
         currentForm->submitIfPossible(&event); // Event handlers can run.
 
-    protectedElement->setActivatedSubmit(false);
     event.setDefaultHandled();
 }

trunk/Source/WebCore/html/SubmitInputType.cpp

@@ -75 +75 @@
     protectedElement->document().updateLayoutIgnorePendingStylesheets();
 
-    protectedElement->setActivatedSubmit(true);
     if (RefPtr currentForm = protectedElement->form())
         currentForm->submitIfPossible(&event, element()); // Event handlers can run.
-    protectedElement->setActivatedSubmit(false);
     event.setDefaultHandled();
 }