Bug 17042 – <form> tags used without action attribute but with a <base> tag

• Component: Forms
• Status: VERIFIED FIXED

[Robert Sesek]

When a HTML document has <base> tag, all relative URIs should be resolved in regards to that (as per the W3 spec on the matter: http://www.w3.org/TR/html401/struct/links.html#h-12.4). However, the handling of <form> elements without an "action" attribute is incorrect (when using Firefox and the HTML spec as references).

If you were to use a <form> tag without an action attribute alongside a <base> tag, then the form will submit to *only* to the href of the <base> tag. Normally, when a <form> tag does not have an action attribute and a <base> tag is not present, the form submits to the originating page.

Thus, the logical behavior should be as follows: when a <form> tag does not have an action attribute and a <base> tag is present, then the form should submit to the href of the <base> tag concatenated by the originating page.

Example:

Base Tag: http://example.com/base/
Originating page: foo.php

Current implementation would submit to: http://example.com/base/
Fixing this bug would result in submitting to: http://example.com/base/foo.php

[Robert Sesek]

Created attachment 18734 [details]
Testcase

[Alexey Proskuryakov]

Both Firefox 2.0.0.9 and IE7 seem to ignore base URI when submitting this form (and submit to <http://bugs.webkit.org/attachment.cgi?submit=Submit+The+Form>). Are you seeing different results?

Does this issue affect any actual sites? This would make it more important, of course.

Confirming as a difference with IE and Firefox, but I'm not sure what behavior would be best.

[Robert Sesek]

The only site that I've experienced this issue on is the internal website we use at my job, so the criticality of it is very low (as far as I can tell).

As for the behavior, logically I think it makes the most sense to submit to (from the attachment):

http://localhost/foo/zoo/base/attachment.cgi?submit=Submit+The+Form

The reasoning: you take the <base> because all relative URIs should be resolved from that. Then concatenate the originating page's basename (in this case attachment.cgi) because when <form>s do not have an action attribute, it submits to the originating page.

However, this would probably break away from the implementation of IE and FF, so perhaps just submitting to the full URL of the originating page is the best way to do it.

[Robert Sesek]

Created attachment 18741 [details]
Patch using FF and IE implementation

Here's a patch that would implement the Firefox and IE behavior.

[Darin Adler]

Comment on attachment 18741 [details]
Patch using FF and IE implementation

Thanks for contributing this fix!

The code change looks OK to me, but we need a regression test. That's the policy for the WebKit project -- we require a test for any bug we fix.

The LayoutTests/fast/forms directory has lots of form tests. You can probably start with one of those to make a test. For example, empty-get.html.

[Robert Sesek]

Created attachment 18808 [details]
Patch, take 2

Sorry about not submitting the test, I'm not familiar with the procedure. I have updated the patch to include a layout test for this bug.

[Darin Adler]

Comment on attachment 18808 [details]
Patch, take 2

r=me

[Mark Rowe (bdash)]

Landed in r29989.  Thanks for the patch!