1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
2 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
3 /* This Source Code Form is subject to the terms of the Mozilla Public
4 * License, v. 2.0. If a copy of the MPL was not distributed with this
5 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
7 #include "mozilla/dom/HTMLFormElement.h"
10 #include "mozilla/ContentEvents.h"
11 #include "mozilla/EventDispatcher.h"
12 #include "mozilla/EventStates.h"
13 #include "mozilla/dom/BindContext.h"
14 #include "mozilla/dom/nsCSPUtils.h"
15 #include "mozilla/dom/nsCSPContext.h"
16 #include "mozilla/dom/nsMixedContentBlocker.h"
17 #include "mozilla/dom/CustomEvent.h"
18 #include "mozilla/dom/HTMLFormControlsCollection.h"
19 #include "mozilla/dom/HTMLFormElementBinding.h"
20 #include "mozilla/Move.h"
21 #include "nsGkAtoms.h"
22 #include "nsHTMLDocument.h"
23 #include "nsStyleConsts.h"
24 #include "nsPresContext.h"
25 #include "mozilla/dom/Document.h"
26 #include "nsIFormControlFrame.h"
28 #include "nsContentUtils.h"
29 #include "nsHTMLDocument.h"
30 #include "nsInterfaceHashtable.h"
31 #include "nsContentList.h"
32 #include "nsCOMArray.h"
33 #include "nsAutoPtr.h"
35 #include "nsIMutableArray.h"
36 #include "mozilla/BinarySearch.h"
37 #include "nsQueryObject.h"
40 #include "HTMLFormSubmissionConstants.h"
41 #include "mozilla/dom/FormData.h"
42 #include "mozilla/Telemetry.h"
43 #include "nsIFormSubmitObserver.h"
44 #include "nsIObserverService.h"
45 #include "nsICategoryManager.h"
46 #include "nsCategoryManagerUtils.h"
47 #include "nsISimpleEnumerator.h"
49 #include "nsIScriptError.h"
50 #include "nsIScriptSecurityManager.h"
51 #include "nsNetUtil.h"
52 #include "nsIInterfaceRequestorUtils.h"
53 #include "nsIWebProgress.h"
54 #include "nsIDocShell.h"
55 #include "nsIPrompt.h"
56 #include "nsISecurityUITelemetry.h"
57 #include "nsIStringBundle.h"
58 #include "nsIProtocolHandler.h"
61 #include "mozilla/dom/HTMLInputElement.h"
62 #include "nsIRadioVisitor.h"
63 #include "RadioNodeList.h"
65 #include "nsLayoutUtils.h"
67 #include "mozAutoDocUpdate.h"
68 #include "nsIHTMLCollection.h"
70 #include "nsIConstraintValidation.h"
72 #include "nsSandboxFlags.h"
74 #include "nsIContentSecurityPolicy.h"
77 #include "mozilla/dom/HTMLImageElement.h"
78 #include "mozilla/dom/HTMLButtonElement.h"
80 // construction, destruction
81 NS_IMPL_NS_NEW_HTML_ELEMENT(Form
)
86 static const uint8_t NS_FORM_AUTOCOMPLETE_ON
= 1;
87 static const uint8_t NS_FORM_AUTOCOMPLETE_OFF
= 0;
89 static const nsAttrValue::EnumTable kFormAutocompleteTable
[] = {
90 {"on", NS_FORM_AUTOCOMPLETE_ON
},
91 {"off", NS_FORM_AUTOCOMPLETE_OFF
},
93 // Default autocomplete value is 'on'.
94 static const nsAttrValue::EnumTable
* kFormDefaultAutocomplete
=
95 &kFormAutocompleteTable
[0];
97 HTMLFormElement::HTMLFormElement(
98 already_AddRefed
<mozilla::dom::NodeInfo
>&& aNodeInfo
)
99 : nsGenericHTMLElement(std::move(aNodeInfo
)),
100 mControls(new HTMLFormControlsCollection(this)),
101 mSelectedRadioButtons(2),
102 mRequiredRadioButtonCounts(2),
103 mValueMissingRadioGroups(2),
104 mPendingSubmission(nullptr),
105 mSubmittingRequest(nullptr),
106 mDefaultSubmitElement(nullptr),
107 mFirstSubmitInElements(nullptr),
108 mFirstSubmitNotInElements(nullptr),
109 mImageNameLookupTable(FORM_CONTROL_LIST_HASHTABLE_LENGTH
),
110 mPastNameLookupTable(FORM_CONTROL_LIST_HASHTABLE_LENGTH
),
111 mSubmitPopupState(PopupBlocker::openAbused
),
112 mInvalidElementsCount(0),
114 mGeneratingSubmit(false),
115 mGeneratingReset(false),
116 mIsSubmitting(false),
117 mDeferSubmission(false),
118 mNotifiedObservers(false),
119 mNotifiedObserversResult(false),
120 mEverTriedInvalidSubmit(false) {
121 // We start out valid.
122 AddStatesSilently(NS_EVENT_STATE_VALID
);
125 HTMLFormElement::~HTMLFormElement() {
127 mControls
->DropFormReference();
135 NS_IMPL_CYCLE_COLLECTION_CLASS(HTMLFormElement
)
137 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(HTMLFormElement
,
138 nsGenericHTMLElement
)
139 NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mControls
)
140 NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mImageNameLookupTable
)
141 NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mPastNameLookupTable
)
142 NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mSelectedRadioButtons
)
143 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
145 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(HTMLFormElement
,
146 nsGenericHTMLElement
)
148 tmp
->mExpandoAndGeneration
.OwnerUnlinked();
149 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
151 NS_IMPL_ISUPPORTS_CYCLE_COLLECTION_INHERITED(HTMLFormElement
,
152 nsGenericHTMLElement
, nsIForm
,
153 nsIWebProgressListener
,
154 nsIRadioGroupContainer
)
157 void HTMLFormElement::AsyncEventRunning(AsyncEventDispatcher
* aEvent
) {
158 if (mFormPasswordEventDispatcher
== aEvent
) {
159 mFormPasswordEventDispatcher
= nullptr;
163 NS_IMPL_ELEMENT_CLONE(HTMLFormElement
)
165 nsIHTMLCollection
* HTMLFormElement::Elements() { return mControls
; }
167 nsresult
HTMLFormElement::BeforeSetAttr(int32_t aNamespaceID
, nsAtom
* aName
,
168 const nsAttrValueOrString
* aValue
,
170 if (aNamespaceID
== kNameSpaceID_None
) {
171 if (aName
== nsGkAtoms::action
|| aName
== nsGkAtoms::target
) {
172 // Don't forget we've notified the password manager already if the
173 // page sets the action/target in the during submit. (bug 343182)
174 bool notifiedObservers
= mNotifiedObservers
;
175 ForgetCurrentSubmission();
176 mNotifiedObservers
= notifiedObservers
;
180 return nsGenericHTMLElement::BeforeSetAttr(aNamespaceID
, aName
, aValue
,
184 nsresult
HTMLFormElement::AfterSetAttr(int32_t aNameSpaceID
, nsAtom
* aName
,
185 const nsAttrValue
* aValue
,
186 const nsAttrValue
* aOldValue
,
187 nsIPrincipal
* aSubjectPrincipal
,
189 if (aName
== nsGkAtoms::novalidate
&& aNameSpaceID
== kNameSpaceID_None
) {
190 // Update all form elements states because they might be [no longer]
191 // affected by :-moz-ui-valid or :-moz-ui-invalid.
192 for (uint32_t i
= 0, length
= mControls
->mElements
.Length(); i
< length
;
194 mControls
->mElements
[i
]->UpdateState(true);
197 for (uint32_t i
= 0, length
= mControls
->mNotInElements
.Length();
199 mControls
->mNotInElements
[i
]->UpdateState(true);
203 return nsGenericHTMLElement::AfterSetAttr(
204 aNameSpaceID
, aName
, aValue
, aOldValue
, aSubjectPrincipal
, aNotify
);
207 void HTMLFormElement::GetAutocomplete(nsAString
& aValue
) {
208 GetEnumAttr(nsGkAtoms::autocomplete
, kFormDefaultAutocomplete
->tag
, aValue
);
211 void HTMLFormElement::GetEnctype(nsAString
& aValue
) {
212 GetEnumAttr(nsGkAtoms::enctype
, kFormDefaultEnctype
->tag
, aValue
);
215 void HTMLFormElement::GetMethod(nsAString
& aValue
) {
216 GetEnumAttr(nsGkAtoms::method
, kFormDefaultMethod
->tag
, aValue
);
219 void HTMLFormElement::Submit(ErrorResult
& aRv
) {
220 // Send the submit event
221 if (mPendingSubmission
) {
222 // aha, we have a pending submission that was not flushed
223 // (this happens when form.submit() is called twice)
224 // we have to delete it and build a new one since values
225 // might have changed inbetween (we emulate IE here, that's all)
226 mPendingSubmission
= nullptr;
229 aRv
= DoSubmitOrReset(nullptr, eFormSubmit
);
232 void HTMLFormElement::Reset() {
233 InternalFormEvent
event(true, eFormReset
);
234 EventDispatcher::Dispatch(static_cast<nsIContent
*>(this), nullptr, &event
);
237 bool HTMLFormElement::ParseAttribute(int32_t aNamespaceID
, nsAtom
* aAttribute
,
238 const nsAString
& aValue
,
239 nsIPrincipal
* aMaybeScriptedPrincipal
,
240 nsAttrValue
& aResult
) {
241 if (aNamespaceID
== kNameSpaceID_None
) {
242 if (aAttribute
== nsGkAtoms::method
) {
243 return aResult
.ParseEnumValue(aValue
, kFormMethodTable
, false);
245 if (aAttribute
== nsGkAtoms::enctype
) {
246 return aResult
.ParseEnumValue(aValue
, kFormEnctypeTable
, false);
248 if (aAttribute
== nsGkAtoms::autocomplete
) {
249 return aResult
.ParseEnumValue(aValue
, kFormAutocompleteTable
, false);
253 return nsGenericHTMLElement::ParseAttribute(aNamespaceID
, aAttribute
, aValue
,
254 aMaybeScriptedPrincipal
, aResult
);
257 nsresult
HTMLFormElement::BindToTree(BindContext
& aContext
, nsINode
& aParent
) {
258 nsresult rv
= nsGenericHTMLElement::BindToTree(aContext
, aParent
);
259 NS_ENSURE_SUCCESS(rv
, rv
);
261 if (IsInUncomposedDoc() && aContext
.OwnerDoc().IsHTMLOrXHTML()) {
262 aContext
.OwnerDoc().AsHTMLDocument()->AddedForm();
268 template <typename T
>
269 static void MarkOrphans(const nsTArray
<T
*>& aArray
) {
270 uint32_t length
= aArray
.Length();
271 for (uint32_t i
= 0; i
< length
; ++i
) {
272 aArray
[i
]->SetFlags(MAYBE_ORPHAN_FORM_ELEMENT
);
276 static void CollectOrphans(nsINode
* aRemovalRoot
,
277 const nsTArray
<nsGenericHTMLFormElement
*>& aArray
280 HTMLFormElement
* aThisForm
283 // Put a script blocker around all the notifications we're about to do.
284 nsAutoScriptBlocker scriptBlocker
;
286 // Walk backwards so that if we remove elements we can just keep iterating
287 uint32_t length
= aArray
.Length();
288 for (uint32_t i
= length
; i
> 0; --i
) {
289 nsGenericHTMLFormElement
* node
= aArray
[i
- 1];
291 // Now if MAYBE_ORPHAN_FORM_ELEMENT is not set, that would mean that the
292 // node is in fact a descendant of the form and hence should stay in the
293 // form. If it _is_ set, then we need to check whether the node is a
294 // descendant of aRemovalRoot. If it is, we leave it in the form.
296 bool removed
= false;
298 if (node
->HasFlag(MAYBE_ORPHAN_FORM_ELEMENT
)) {
299 node
->UnsetFlags(MAYBE_ORPHAN_FORM_ELEMENT
);
300 if (!node
->IsInclusiveDescendantOf(aRemovalRoot
)) {
301 node
->ClearForm(true, false);
303 // When a form control loses its form owner, its state can change.
304 node
->UpdateState(true);
313 HTMLFormElement
* form
= node
->GetForm();
314 NS_ASSERTION(form
== aThisForm
, "How did that happen?");
320 static void CollectOrphans(nsINode
* aRemovalRoot
,
321 const nsTArray
<HTMLImageElement
*>& aArray
324 HTMLFormElement
* aThisForm
327 // Walk backwards so that if we remove elements we can just keep iterating
328 uint32_t length
= aArray
.Length();
329 for (uint32_t i
= length
; i
> 0; --i
) {
330 HTMLImageElement
* node
= aArray
[i
- 1];
332 // Now if MAYBE_ORPHAN_FORM_ELEMENT is not set, that would mean that the
333 // node is in fact a descendant of the form and hence should stay in the
334 // form. If it _is_ set, then we need to check whether the node is a
335 // descendant of aRemovalRoot. If it is, we leave it in the form.
337 bool removed
= false;
339 if (node
->HasFlag(MAYBE_ORPHAN_FORM_ELEMENT
)) {
340 node
->UnsetFlags(MAYBE_ORPHAN_FORM_ELEMENT
);
341 if (!node
->IsInclusiveDescendantOf(aRemovalRoot
)) {
342 node
->ClearForm(true);
352 HTMLFormElement
* form
= node
->GetForm();
353 NS_ASSERTION(form
== aThisForm
, "How did that happen?");
359 void HTMLFormElement::UnbindFromTree(bool aNullParent
) {
360 // Note, this is explicitly using uncomposed doc, since we count
361 // only forms in document.
362 RefPtr
<Document
> oldDocument
= GetUncomposedDoc();
364 // Mark all of our controls as maybe being orphans
365 MarkOrphans(mControls
->mElements
);
366 MarkOrphans(mControls
->mNotInElements
);
367 MarkOrphans(mImageElements
);
369 nsGenericHTMLElement::UnbindFromTree(aNullParent
);
371 nsINode
* ancestor
= this;
374 cur
= ancestor
->GetParentNode();
381 CollectOrphans(ancestor
, mControls
->mElements
387 CollectOrphans(ancestor
, mControls
->mNotInElements
393 CollectOrphans(ancestor
, mImageElements
400 if (oldDocument
&& oldDocument
->IsHTMLOrXHTML()) {
401 oldDocument
->AsHTMLDocument()->RemovedForm();
403 ForgetCurrentSubmission();
406 void HTMLFormElement::GetEventTargetParent(EventChainPreVisitor
& aVisitor
) {
407 aVisitor
.mWantsWillHandleEvent
= true;
408 if (aVisitor
.mEvent
->mOriginalTarget
== static_cast<nsIContent
*>(this)) {
409 uint32_t msg
= aVisitor
.mEvent
->mMessage
;
410 if (msg
== eFormSubmit
) {
411 if (mGeneratingSubmit
) {
412 aVisitor
.mCanHandle
= false;
415 mGeneratingSubmit
= true;
417 // let the form know that it needs to defer the submission,
418 // that means that if there are scripted submissions, the
419 // latest one will be deferred until after the exit point of the handler.
420 mDeferSubmission
= true;
421 } else if (msg
== eFormReset
) {
422 if (mGeneratingReset
) {
423 aVisitor
.mCanHandle
= false;
426 mGeneratingReset
= true;
429 nsGenericHTMLElement::GetEventTargetParent(aVisitor
);
432 void HTMLFormElement::WillHandleEvent(EventChainPostVisitor
& aVisitor
) {
433 // If this is the bubble stage and there is a nested form below us which
434 // received a submit event we do *not* want to handle the submit event
435 // for this form too.
436 if ((aVisitor
.mEvent
->mMessage
== eFormSubmit
||
437 aVisitor
.mEvent
->mMessage
== eFormReset
) &&
438 aVisitor
.mEvent
->mFlags
.mInBubblingPhase
&&
439 aVisitor
.mEvent
->mOriginalTarget
!= static_cast<nsIContent
*>(this)) {
440 aVisitor
.mEvent
->StopPropagation();
444 nsresult
HTMLFormElement::PostHandleEvent(EventChainPostVisitor
& aVisitor
) {
445 if (aVisitor
.mEvent
->mOriginalTarget
== static_cast<nsIContent
*>(this)) {
446 EventMessage msg
= aVisitor
.mEvent
->mMessage
;
447 if (msg
== eFormSubmit
) {
448 // let the form know not to defer subsequent submissions
449 mDeferSubmission
= false;
452 if (aVisitor
.mEventStatus
== nsEventStatus_eIgnore
) {
456 if (mPendingSubmission
&& msg
== eFormSubmit
) {
457 // tell the form to forget a possible pending submission.
458 // the reason is that the script returned true (the event was
459 // ignored) so if there is a stored submission, it will miss
460 // the name/value of the submitting element, thus we need
461 // to forget it and the form element will build a new one
462 mPendingSubmission
= nullptr;
464 DoSubmitOrReset(aVisitor
.mEvent
, msg
);
471 if (msg
== eFormSubmit
) {
472 // tell the form to flush a possible pending submission.
473 // the reason is that the script returned false (the event was
474 // not ignored) so if there is a stored submission, it needs to
475 // be submitted immediatelly.
476 FlushPendingSubmission();
480 if (msg
== eFormSubmit
) {
481 mGeneratingSubmit
= false;
482 } else if (msg
== eFormReset
) {
483 mGeneratingReset
= false;
489 nsresult
HTMLFormElement::DoSubmitOrReset(WidgetEvent
* aEvent
,
490 EventMessage aMessage
) {
491 // Make sure the presentation is up-to-date
492 Document
* doc
= GetComposedDoc();
494 doc
->FlushPendingNotifications(FlushType::ContentAndNotify
);
497 // JBK Don't get form frames anymore - bug 34297
499 // Submit or Reset the form
500 if (eFormReset
== aMessage
) {
504 if (eFormSubmit
== aMessage
) {
505 // Don't submit if we're not in a document or if we're in
506 // a sandboxed frame and form submit is disabled.
507 if (!doc
|| (doc
->GetSandboxFlags() & SANDBOXED_FORMS
)) {
510 return DoSubmit(aEvent
);
517 nsresult
HTMLFormElement::DoReset() {
518 mEverTriedInvalidSubmit
= false;
519 // JBK walk the elements[] array instead of form frame controls - bug 34297
520 uint32_t numElements
= GetElementCount();
521 for (uint32_t elementX
= 0; elementX
< numElements
; ++elementX
) {
522 // Hold strong ref in case the reset does something weird
523 nsCOMPtr
<nsIFormControl
> controlNode
= GetElementAt(elementX
);
525 controlNode
->Reset();
532 #define NS_ENSURE_SUBMIT_SUCCESS(rv) \
533 if (NS_FAILED(rv)) { \
534 ForgetCurrentSubmission(); \
538 nsresult
HTMLFormElement::DoSubmit(WidgetEvent
* aEvent
) {
539 NS_ASSERTION(GetComposedDoc(), "Should never get here without a current doc");
542 NS_WARNING("Preventing double form submission");
543 // XXX Should this return an error?
547 // Mark us as submitting so that we don't try to submit again
548 mIsSubmitting
= true;
549 NS_ASSERTION(!mWebProgress
&& !mSubmittingRequest
,
550 "Web progress / submitting request should not exist here!");
552 nsAutoPtr
<HTMLFormSubmission
> submission
;
555 // prepare the submission object
557 nsresult rv
= BuildSubmission(getter_Transfers(submission
), aEvent
);
559 mIsSubmitting
= false;
563 // XXXbz if the script global is that for an sXBL/XBL2 doc, it won't
565 nsPIDOMWindowOuter
* window
= OwnerDoc()->GetWindow();
567 mSubmitPopupState
= PopupBlocker::GetPopupControlState();
569 mSubmitPopupState
= PopupBlocker::openAbused
;
572 if (mDeferSubmission
) {
573 // we are in an event handler, JS submitted so we have to
574 // defer this submission. let's remember it and return
575 // without submitting
576 mPendingSubmission
= submission
;
578 mIsSubmitting
= false;
583 // perform the submission
585 return SubmitSubmission(submission
);
588 nsresult
HTMLFormElement::BuildSubmission(HTMLFormSubmission
** aFormSubmission
,
589 WidgetEvent
* aEvent
) {
590 NS_ASSERTION(!mPendingSubmission
, "tried to build two submissions!");
592 // Get the originating frame (failure is non-fatal)
593 nsGenericHTMLElement
* originatingElement
= nullptr;
595 InternalFormEvent
* formEvent
= aEvent
->AsFormEvent();
597 nsIContent
* originator
= formEvent
->mOriginator
;
599 if (!originator
->IsHTMLElement()) {
600 return NS_ERROR_UNEXPECTED
;
602 originatingElement
= static_cast<nsGenericHTMLElement
*>(originator
);
610 // Get the submission object
612 rv
= HTMLFormSubmission::GetFromForm(this, originatingElement
,
614 NS_ENSURE_SUBMIT_SUCCESS(rv
);
617 // Dump the data into the submission object
619 rv
= WalkFormElements(*aFormSubmission
);
620 NS_ENSURE_SUBMIT_SUCCESS(rv
);
625 nsresult
HTMLFormElement::SubmitSubmission(
626 HTMLFormSubmission
* aFormSubmission
) {
629 nsCOMPtr
<nsIURI
> actionURI
= aFormSubmission
->GetActionURL();
631 mIsSubmitting
= false;
635 // If there is no link handler, then we won't actually be able to submit.
636 Document
* doc
= GetComposedDoc();
637 nsCOMPtr
<nsIDocShell
> container
= doc
? doc
->GetDocShell() : nullptr;
638 if (!container
|| IsEditable()) {
639 mIsSubmitting
= false;
643 // javascript URIs are not really submissions; they just call a function.
644 // Also, they may synchronously call submit(), and we want them to be able to
645 // do so while still disallowing other double submissions. (Bug 139798)
646 // Note that any other URI types that are of equivalent type should also be
648 // XXXbz this is a mess. The real issue here is that nsJSChannel sets the
649 // LOAD_BACKGROUND flag, so doesn't notify us, compounded by the fact that
650 // the JS executes before we forget the submission in OnStateChange on
651 // STATE_STOP. As a result, we have to make sure that we simply pretend
652 // we're not submitting when submitting to a JS URL. That's kinda bogus, but
654 bool schemeIsJavaScript
= false;
655 if (NS_SUCCEEDED(actionURI
->SchemeIs("javascript", &schemeIsJavaScript
)) &&
656 schemeIsJavaScript
) {
657 mIsSubmitting
= false;
661 // Notify observers of submit
663 bool cancelSubmit
= false;
664 if (mNotifiedObservers
) {
665 cancelSubmit
= mNotifiedObserversResult
;
667 rv
= NotifySubmitObservers(actionURI
, &cancelSubmit
, true);
668 NS_ENSURE_SUBMIT_SUCCESS(rv
);
672 mIsSubmitting
= false;
676 cancelSubmit
= false;
677 rv
= NotifySubmitObservers(actionURI
, &cancelSubmit
, false);
678 NS_ENSURE_SUBMIT_SUCCESS(rv
);
681 mIsSubmitting
= false;
688 nsCOMPtr
<nsIDocShell
> docShell
;
691 AutoPopupStatePusher
popupStatePusher(mSubmitPopupState
);
693 AutoHandlingUserInputStatePusher
userInpStatePusher(
694 aFormSubmission
->IsInitiatedFromUserInput());
696 nsCOMPtr
<nsIInputStream
> postDataStream
;
697 rv
= aFormSubmission
->GetEncodedSubmission(
698 actionURI
, getter_AddRefs(postDataStream
), actionURI
);
699 NS_ENSURE_SUBMIT_SUCCESS(rv
);
702 aFormSubmission
->GetTarget(target
);
703 rv
= nsDocShell::Cast(container
)->OnLinkClickSync(
704 this, actionURI
, target
, VoidString(), postDataStream
, nullptr, false,
705 getter_AddRefs(docShell
), getter_AddRefs(mSubmittingRequest
),
706 aFormSubmission
->IsInitiatedFromUserInput());
707 NS_ENSURE_SUBMIT_SUCCESS(rv
);
710 // Even if the submit succeeds, it's possible for there to be no docshell
711 // or request; for example, if it's to a named anchor within the same page
712 // the submit will not really do anything.
714 // If the channel is pending, we have to listen for web progress.
715 bool pending
= false;
716 mSubmittingRequest
->IsPending(&pending
);
717 if (pending
&& !schemeIsJavaScript
) {
718 nsCOMPtr
<nsIWebProgress
> webProgress
= do_GetInterface(docShell
);
719 NS_ASSERTION(webProgress
, "nsIDocShell not converted to nsIWebProgress!");
720 rv
= webProgress
->AddProgressListener(this,
721 nsIWebProgress::NOTIFY_STATE_ALL
);
722 NS_ENSURE_SUBMIT_SUCCESS(rv
);
723 mWebProgress
= do_GetWeakReference(webProgress
);
724 NS_ASSERTION(mWebProgress
, "can't hold weak ref to webprogress!");
726 ForgetCurrentSubmission();
729 ForgetCurrentSubmission();
735 nsresult
HTMLFormElement::DoSecureToInsecureSubmitCheck(nsIURI
* aActionURL
,
736 bool* aCancelSubmit
) {
737 *aCancelSubmit
= false;
739 // Only ask the user about posting from a secure URI to an insecure URI if
740 // this element is in the root document. When this is not the case, the mixed
741 // content blocker will take care of security for us.
742 Document
* parent
= OwnerDoc()->GetParentDocument();
743 bool isRootDocument
= (!parent
|| nsContentUtils::IsChromeDoc(parent
));
744 if (!isRootDocument
) {
748 nsIPrincipal
* principal
= NodePrincipal();
750 *aCancelSubmit
= true;
753 nsCOMPtr
<nsIURI
> principalURI
;
754 nsresult rv
= principal
->GetURI(getter_AddRefs(principalURI
));
759 principalURI
= OwnerDoc()->GetDocumentURI();
762 rv
= principalURI
->SchemeIs("https", &formIsHTTPS
);
771 if (nsMixedContentBlocker::IsPotentiallyTrustworthyLoopbackURL(aActionURL
)) {
775 if (nsMixedContentBlocker::URISafeToBeLoadedInSecureContext(aActionURL
)) {
779 if (nsMixedContentBlocker::IsPotentiallyTrustworthyOnion(aActionURL
)) {
783 nsCOMPtr
<nsPIDOMWindowOuter
> window
= OwnerDoc()->GetWindow();
785 return NS_ERROR_FAILURE
;
787 nsCOMPtr
<nsIDocShell
> docShell
= window
->GetDocShell();
789 return NS_ERROR_FAILURE
;
791 nsCOMPtr
<nsIPrompt
> prompt
= do_GetInterface(docShell
);
793 return NS_ERROR_FAILURE
;
795 nsCOMPtr
<nsIStringBundle
> stringBundle
;
796 nsCOMPtr
<nsIStringBundleService
> stringBundleService
=
797 mozilla::services::GetStringBundleService();
798 if (!stringBundleService
) {
799 return NS_ERROR_FAILURE
;
801 rv
= stringBundleService
->CreateBundle(
802 "chrome://global/locale/browser.properties",
803 getter_AddRefs(stringBundle
));
808 nsAutoString message
;
810 stringBundle
->GetStringFromName("formPostSecureToInsecureWarning.title",
812 stringBundle
->GetStringFromName("formPostSecureToInsecureWarning.message",
814 stringBundle
->GetStringFromName("formPostSecureToInsecureWarning.continue",
816 int32_t buttonPressed
;
818 false; // this is unused (ConfirmEx requires this parameter)
819 rv
= prompt
->ConfirmEx(
820 title
.get(), message
.get(),
821 (nsIPrompt::BUTTON_TITLE_IS_STRING
* nsIPrompt::BUTTON_POS_0
) +
822 (nsIPrompt::BUTTON_TITLE_CANCEL
* nsIPrompt::BUTTON_POS_1
),
823 cont
.get(), nullptr, nullptr, nullptr, &checkState
, &buttonPressed
);
827 *aCancelSubmit
= (buttonPressed
== 1);
828 uint32_t telemetryBucket
=
829 nsISecurityUITelemetry::WARNING_CONFIRM_POST_TO_INSECURE_FROM_SECURE
;
830 mozilla::Telemetry::Accumulate(mozilla::Telemetry::SECURITY_UI
,
832 if (!*aCancelSubmit
) {
833 // The user opted to continue, so note that in the next telemetry bucket.
834 mozilla::Telemetry::Accumulate(mozilla::Telemetry::SECURITY_UI
,
835 telemetryBucket
+ 1);
840 nsresult
HTMLFormElement::NotifySubmitObservers(nsIURI
* aActionURL
,
844 nsresult rv
= DoSecureToInsecureSubmitCheck(aActionURL
, aCancelSubmit
);
848 if (*aCancelSubmit
) {
853 bool defaultAction
= true;
854 nsresult rv
= nsContentUtils::DispatchEventOnlyToChrome(
855 OwnerDoc(), static_cast<nsINode
*>(this),
856 aEarlyNotify
? NS_LITERAL_STRING("DOMFormBeforeSubmit")
857 : NS_LITERAL_STRING("DOMFormSubmit"),
858 CanBubble::eYes
, Cancelable::eYes
, &defaultAction
);
859 *aCancelSubmit
= !defaultAction
;
860 if (*aCancelSubmit
) {
866 nsresult
HTMLFormElement::WalkFormElements(
867 HTMLFormSubmission
* aFormSubmission
) {
868 // This shouldn't be called recursively, so use a rather large value
869 // for the preallocated buffer.
870 AutoTArray
<RefPtr
<nsGenericHTMLFormElement
>, 100> sortedControls
;
871 nsresult rv
= mControls
->GetSortedControls(sortedControls
);
872 NS_ENSURE_SUCCESS(rv
, rv
);
874 uint32_t len
= sortedControls
.Length();
877 // Walk the list of nodes and call SubmitNamesValues() on the controls
879 for (uint32_t i
= 0; i
< len
; ++i
) {
880 // Tell the control to submit its name/value pairs to the submission
881 sortedControls
[i
]->SubmitNamesValues(aFormSubmission
);
889 NS_IMETHODIMP_(uint32_t)
890 HTMLFormElement::GetElementCount() const { return mControls
->Length(); }
892 Element
* HTMLFormElement::IndexedGetter(uint32_t aIndex
, bool& aFound
) {
893 Element
* element
= mControls
->mElements
.SafeElementAt(aIndex
, nullptr);
894 aFound
= element
!= nullptr;
898 NS_IMETHODIMP_(nsIFormControl
*)
899 HTMLFormElement::GetElementAt(int32_t aIndex
) const {
900 return mControls
->mElements
.SafeElementAt(aIndex
, nullptr);
904 * Compares the position of aControl1 and aControl2 in the document
905 * @param aControl1 First control to compare.
906 * @param aControl2 Second control to compare.
907 * @param aForm Parent form of the controls.
908 * @return < 0 if aControl1 is before aControl2,
909 * > 0 if aControl1 is after aControl2,
913 int32_t HTMLFormElement::CompareFormControlPosition(Element
* aElement1
,
915 const nsIContent
* aForm
) {
916 NS_ASSERTION(aElement1
!= aElement2
, "Comparing a form control to itself");
918 // If an element has a @form, we can assume it *might* be able to not have
919 // a parent and still be in the form.
920 NS_ASSERTION((aElement1
->HasAttr(kNameSpaceID_None
, nsGkAtoms::form
) ||
921 aElement1
->GetParent()) &&
922 (aElement2
->HasAttr(kNameSpaceID_None
, nsGkAtoms::form
) ||
923 aElement2
->GetParent()),
924 "Form controls should always have parents");
926 // If we pass aForm, we are assuming both controls are form descendants which
927 // is not always the case. This function should work but maybe slower.
928 // However, checking if both elements are form descendants may be slow too...
929 // TODO: remove the prevent asserts fix, see bug 598468.
931 nsLayoutUtils::gPreventAssertInCompareTreePosition
= true;
933 nsLayoutUtils::CompareTreePosition(aElement1
, aElement2
, aForm
);
934 nsLayoutUtils::gPreventAssertInCompareTreePosition
= false;
938 return nsLayoutUtils::CompareTreePosition(aElement1
, aElement2
, aForm
);
944 * Checks that all form elements are in document order. Asserts if any pair of
945 * consecutive elements are not in increasing document order.
947 * @param aControls List of form controls to check.
948 * @param aForm Parent form of the controls.
951 void HTMLFormElement::AssertDocumentOrder(
952 const nsTArray
<nsGenericHTMLFormElement
*>& aControls
, nsIContent
* aForm
) {
953 // TODO: remove the return statement with bug 598468.
954 // This is done to prevent asserts in some edge cases.
957 // Only iterate if aControls is not empty, since otherwise
958 // |aControls.Length() - 1| will be a very large unsigned number... not what
960 if (!aControls
.IsEmpty()) {
961 for (uint32_t i
= 0; i
< aControls
.Length() - 1; ++i
) {
963 CompareFormControlPosition(aControls
[i
], aControls
[i
+ 1], aForm
) < 0,
964 "Form controls not ordered correctly");
970 * Copy of the above function, but with RefPtrs.
972 * @param aControls List of form controls to check.
973 * @param aForm Parent form of the controls.
976 void HTMLFormElement::AssertDocumentOrder(
977 const nsTArray
<RefPtr
<nsGenericHTMLFormElement
>>& aControls
,
979 // TODO: remove the return statement with bug 598468.
980 // This is done to prevent asserts in some edge cases.
983 // Only iterate if aControls is not empty, since otherwise
984 // |aControls.Length() - 1| will be a very large unsigned number... not what
986 if (!aControls
.IsEmpty()) {
987 for (uint32_t i
= 0; i
< aControls
.Length() - 1; ++i
) {
989 CompareFormControlPosition(aControls
[i
], aControls
[i
+ 1], aForm
) < 0,
990 "Form controls not ordered correctly");
996 void HTMLFormElement::PostPasswordEvent() {
997 // Don't fire another add event if we have a pending add event.
998 if (mFormPasswordEventDispatcher
.get()) {
1002 mFormPasswordEventDispatcher
=
1003 new AsyncEventDispatcher(this, NS_LITERAL_STRING("DOMFormHasPassword"),
1004 CanBubble::eYes
, ChromeOnlyDispatch::eYes
);
1005 mFormPasswordEventDispatcher
->PostDOMEvent();
1010 struct FormComparator
{
1011 Element
* const mChild
;
1012 HTMLFormElement
* const mForm
;
1013 FormComparator(Element
* aChild
, HTMLFormElement
* aForm
)
1014 : mChild(aChild
), mForm(aForm
) {}
1015 int operator()(Element
* aElement
) const {
1016 return HTMLFormElement::CompareFormControlPosition(mChild
, aElement
, mForm
);
1022 // This function return true if the element, once appended, is the last one in
1024 template <typename ElementType
>
1025 static bool AddElementToList(nsTArray
<ElementType
*>& aList
, ElementType
* aChild
,
1026 HTMLFormElement
* aForm
) {
1027 NS_ASSERTION(aList
.IndexOf(aChild
) == aList
.NoIndex
,
1028 "aChild already in aList");
1030 const uint32_t count
= aList
.Length();
1031 ElementType
* element
;
1032 bool lastElement
= false;
1034 // Optimize most common case where we insert at the end.
1035 int32_t position
= -1;
1037 element
= aList
[count
- 1];
1039 HTMLFormElement::CompareFormControlPosition(aChild
, element
, aForm
);
1042 // If this item comes after the last element, or the elements array is
1043 // empty, we append to the end. Otherwise, we do a binary search to
1044 // determine where the element should go.
1045 if (position
>= 0 || count
== 0) {
1046 // WEAK - don't addref
1047 aList
.AppendElement(aChild
);
1051 BinarySearchIf(aList
, 0, count
, FormComparator(aChild
, aForm
), &idx
);
1053 // WEAK - don't addref
1054 aList
.InsertElementAt(idx
, aChild
);
1060 nsresult
HTMLFormElement::AddElement(nsGenericHTMLFormElement
* aChild
,
1061 bool aUpdateValidity
, bool aNotify
) {
1062 // If an element has a @form, we can assume it *might* be able to not have
1063 // a parent and still be in the form.
1064 NS_ASSERTION(aChild
->HasAttr(kNameSpaceID_None
, nsGkAtoms::form
) ||
1065 aChild
->GetParent(),
1066 "Form control should have a parent");
1068 // Determine whether to add the new element to the elements or
1069 // the not-in-elements list.
1070 bool childInElements
= HTMLFormControlsCollection::ShouldBeInElements(aChild
);
1071 nsTArray
<nsGenericHTMLFormElement
*>& controlList
=
1072 childInElements
? mControls
->mElements
: mControls
->mNotInElements
;
1074 bool lastElement
= AddElementToList(controlList
, aChild
, this);
1077 AssertDocumentOrder(controlList
, this);
1080 int32_t type
= aChild
->ControlType();
1082 // If it is a password control, inform the password manager.
1083 if (type
== NS_FORM_INPUT_PASSWORD
) {
1084 PostPasswordEvent();
1087 // Default submit element handling
1088 if (aChild
->IsSubmitControl()) {
1089 // Update mDefaultSubmitElement, mFirstSubmitInElements,
1090 // mFirstSubmitNotInElements.
1092 nsGenericHTMLFormElement
** firstSubmitSlot
=
1093 childInElements
? &mFirstSubmitInElements
: &mFirstSubmitNotInElements
;
1095 // The new child is the new first submit in its list if the firstSubmitSlot
1096 // is currently empty or if the child is before what's currently in the
1097 // slot. Note that if we already have a control in firstSubmitSlot and
1098 // we're appending this element can't possibly replace what's currently in
1099 // the slot. Also note that aChild can't become the mDefaultSubmitElement
1100 // unless it replaces what's in the slot. If it _does_ replace what's in
1101 // the slot, it becomes the default submit if either the default submit is
1102 // what's in the slot or the child is earlier than the default submit.
1103 nsGenericHTMLFormElement
* oldDefaultSubmit
= mDefaultSubmitElement
;
1104 if (!*firstSubmitSlot
||
1106 CompareFormControlPosition(aChild
, *firstSubmitSlot
, this) < 0)) {
1107 // Update mDefaultSubmitElement if it's currently in a valid state.
1108 // Valid state means either non-null or null because there are in fact
1109 // no submit elements around.
1110 if ((mDefaultSubmitElement
||
1111 (!mFirstSubmitInElements
&& !mFirstSubmitNotInElements
)) &&
1112 (*firstSubmitSlot
== mDefaultSubmitElement
||
1113 CompareFormControlPosition(aChild
, mDefaultSubmitElement
, this) <
1115 mDefaultSubmitElement
= aChild
;
1117 *firstSubmitSlot
= aChild
;
1120 MOZ_ASSERT(mDefaultSubmitElement
== mFirstSubmitInElements
||
1121 mDefaultSubmitElement
== mFirstSubmitNotInElements
||
1122 !mDefaultSubmitElement
,
1123 "What happened here?");
1125 // Notify that the state of the previous default submit element has changed
1126 // if the element which is the default submit element has changed. The new
1127 // default submit element is responsible for its own state update.
1128 if (oldDefaultSubmit
&& oldDefaultSubmit
!= mDefaultSubmitElement
) {
1129 oldDefaultSubmit
->UpdateState(aNotify
);
1133 // If the element is subject to constraint validaton and is invalid, we need
1134 // to update our internal counter.
1135 if (aUpdateValidity
) {
1136 nsCOMPtr
<nsIConstraintValidation
> cvElmt
= do_QueryObject(aChild
);
1137 if (cvElmt
&& cvElmt
->IsCandidateForConstraintValidation() &&
1138 !cvElmt
->IsValid()) {
1139 UpdateValidity(false);
1143 // Notify the radio button it's been added to a group
1144 // This has to be done _after_ UpdateValidity() call to prevent the element
1145 // being count twice.
1146 if (type
== NS_FORM_INPUT_RADIO
) {
1147 RefPtr
<HTMLInputElement
> radio
= static_cast<HTMLInputElement
*>(aChild
);
1148 radio
->AddedToRadioGroup();
1154 nsresult
HTMLFormElement::AddElementToTable(nsGenericHTMLFormElement
* aChild
,
1155 const nsAString
& aName
) {
1156 return mControls
->AddElementToTable(aChild
, aName
);
1159 nsresult
HTMLFormElement::RemoveElement(nsGenericHTMLFormElement
* aChild
,
1160 bool aUpdateValidity
) {
1161 RemoveElementFromPastNamesMap(aChild
);
1164 // Remove it from the radio group if it's a radio button
1166 nsresult rv
= NS_OK
;
1167 if (aChild
->ControlType() == NS_FORM_INPUT_RADIO
) {
1168 RefPtr
<HTMLInputElement
> radio
= static_cast<HTMLInputElement
*>(aChild
);
1169 radio
->WillRemoveFromRadioGroup();
1172 // Determine whether to remove the child from the elements list
1173 // or the not in elements list.
1174 bool childInElements
= HTMLFormControlsCollection::ShouldBeInElements(aChild
);
1175 nsTArray
<nsGenericHTMLFormElement
*>& controls
=
1176 childInElements
? mControls
->mElements
: mControls
->mNotInElements
;
1178 // Find the index of the child. This will be used later if necessary
1179 // to find the default submit.
1180 size_t index
= controls
.IndexOf(aChild
);
1181 NS_ENSURE_STATE(index
!= controls
.NoIndex
);
1183 controls
.RemoveElementAt(index
);
1185 // Update our mFirstSubmit* values.
1186 nsGenericHTMLFormElement
** firstSubmitSlot
=
1187 childInElements
? &mFirstSubmitInElements
: &mFirstSubmitNotInElements
;
1188 if (aChild
== *firstSubmitSlot
) {
1189 *firstSubmitSlot
= nullptr;
1191 // We are removing the first submit in this list, find the new first submit
1192 uint32_t length
= controls
.Length();
1193 for (uint32_t i
= index
; i
< length
; ++i
) {
1194 nsGenericHTMLFormElement
* currentControl
= controls
[i
];
1195 if (currentControl
->IsSubmitControl()) {
1196 *firstSubmitSlot
= currentControl
;
1202 if (aChild
== mDefaultSubmitElement
) {
1203 // Need to reset mDefaultSubmitElement. Do this asynchronously so
1204 // that we're not doing it while the DOM is in flux.
1205 mDefaultSubmitElement
= nullptr;
1206 nsContentUtils::AddScriptRunner(new RemoveElementRunnable(this));
1208 // Note that we don't need to notify on the old default submit (which is
1209 // being removed) because it's either being removed from the DOM or
1210 // changing attributes in a way that makes it responsible for sending its
1211 // own notifications.
1214 // If the element was subject to constraint validaton and is invalid, we need
1215 // to update our internal counter.
1216 if (aUpdateValidity
) {
1217 nsCOMPtr
<nsIConstraintValidation
> cvElmt
= do_QueryObject(aChild
);
1218 if (cvElmt
&& cvElmt
->IsCandidateForConstraintValidation() &&
1219 !cvElmt
->IsValid()) {
1220 UpdateValidity(true);
1227 void HTMLFormElement::HandleDefaultSubmitRemoval() {
1228 if (mDefaultSubmitElement
) {
1229 // Already got reset somehow; nothing else to do here
1233 if (!mFirstSubmitNotInElements
) {
1234 mDefaultSubmitElement
= mFirstSubmitInElements
;
1235 } else if (!mFirstSubmitInElements
) {
1236 mDefaultSubmitElement
= mFirstSubmitNotInElements
;
1238 NS_ASSERTION(mFirstSubmitInElements
!= mFirstSubmitNotInElements
,
1239 "How did that happen?");
1240 // Have both; use the earlier one
1241 mDefaultSubmitElement
=
1242 CompareFormControlPosition(mFirstSubmitInElements
,
1243 mFirstSubmitNotInElements
, this) < 0
1244 ? mFirstSubmitInElements
1245 : mFirstSubmitNotInElements
;
1248 MOZ_ASSERT(mDefaultSubmitElement
== mFirstSubmitInElements
||
1249 mDefaultSubmitElement
== mFirstSubmitNotInElements
,
1250 "What happened here?");
1252 // Notify about change if needed.
1253 if (mDefaultSubmitElement
) {
1254 mDefaultSubmitElement
->UpdateState(true);
1258 nsresult
HTMLFormElement::RemoveElementFromTableInternal(
1259 nsInterfaceHashtable
<nsStringHashKey
, nsISupports
>& aTable
,
1260 nsIContent
* aChild
, const nsAString
& aName
) {
1261 auto entry
= aTable
.Lookup(aName
);
1265 // Single element in the hash, just remove it if it's the one
1266 // we're trying to remove...
1267 if (entry
.Data() == aChild
) {
1269 ++mExpandoAndGeneration
.generation
;
1273 nsCOMPtr
<nsIContent
> content(do_QueryInterface(entry
.Data()));
1278 // If it's not a content node then it must be a RadioNodeList.
1279 MOZ_ASSERT(nsCOMPtr
<RadioNodeList
>(do_QueryInterface(entry
.Data())));
1280 auto* list
= static_cast<RadioNodeList
*>(entry
.Data().get());
1282 list
->RemoveElement(aChild
);
1284 uint32_t length
= list
->Length();
1287 // If the list is empty we remove if from our hash, this shouldn't
1290 ++mExpandoAndGeneration
.generation
;
1291 } else if (length
== 1) {
1292 // Only one element left, replace the list in the hash with the
1294 nsIContent
* node
= list
->Item(0);
1296 entry
.Data() = node
;
1303 nsresult
HTMLFormElement::RemoveElementFromTable(
1304 nsGenericHTMLFormElement
* aElement
, const nsAString
& aName
) {
1305 return mControls
->RemoveElementFromTable(aElement
, aName
);
1308 already_AddRefed
<nsISupports
> HTMLFormElement::NamedGetter(
1309 const nsAString
& aName
, bool& aFound
) {
1312 nsCOMPtr
<nsISupports
> result
= DoResolveName(aName
, true);
1314 AddToPastNamesMap(aName
, result
);
1315 return result
.forget();
1318 result
= mImageNameLookupTable
.GetWeak(aName
);
1320 AddToPastNamesMap(aName
, result
);
1321 return result
.forget();
1324 result
= mPastNameLookupTable
.GetWeak(aName
);
1326 return result
.forget();
1333 void HTMLFormElement::GetSupportedNames(nsTArray
<nsString
>& aRetval
) {
1334 // TODO https://github.com/whatwg/html/issues/1731
1337 already_AddRefed
<nsISupports
> HTMLFormElement::FindNamedItem(
1338 const nsAString
& aName
, nsWrapperCache
** aCache
) {
1339 // FIXME Get the wrapper cache from DoResolveName.
1342 nsCOMPtr
<nsISupports
> result
= NamedGetter(aName
, found
);
1345 return result
.forget();
1351 already_AddRefed
<nsISupports
> HTMLFormElement::DoResolveName(
1352 const nsAString
& aName
, bool aFlushContent
) {
1353 nsCOMPtr
<nsISupports
> result
=
1354 mControls
->NamedItemInternal(aName
, aFlushContent
);
1355 return result
.forget();
1358 void HTMLFormElement::OnSubmitClickBegin(Element
* aOriginatingElement
) {
1359 mDeferSubmission
= true;
1361 // Prepare to run NotifySubmitObservers early before the
1362 // scripts on the page get to modify the form data, possibly
1363 // throwing off any password manager. (bug 257781)
1364 nsCOMPtr
<nsIURI
> actionURI
;
1367 rv
= GetActionURL(getter_AddRefs(actionURI
), aOriginatingElement
);
1368 if (NS_FAILED(rv
) || !actionURI
) return;
1370 // Notify observers of submit if the form is valid.
1371 // TODO: checking for mInvalidElementsCount is a temporary fix that should be
1372 // removed with bug 610402.
1373 if (mInvalidElementsCount
== 0) {
1374 bool cancelSubmit
= false;
1375 rv
= NotifySubmitObservers(actionURI
, &cancelSubmit
, true);
1376 if (NS_SUCCEEDED(rv
)) {
1377 mNotifiedObservers
= true;
1378 mNotifiedObserversResult
= cancelSubmit
;
1383 void HTMLFormElement::OnSubmitClickEnd() { mDeferSubmission
= false; }
1385 void HTMLFormElement::FlushPendingSubmission() {
1386 if (mPendingSubmission
) {
1387 // Transfer owning reference so that the submissioin doesn't get deleted
1389 nsAutoPtr
<HTMLFormSubmission
> submission
= std::move(mPendingSubmission
);
1391 SubmitSubmission(submission
);
1395 void HTMLFormElement::GetAction(nsString
& aValue
) {
1396 if (!GetAttr(kNameSpaceID_None
, nsGkAtoms::action
, aValue
) ||
1398 Document
* document
= OwnerDoc();
1399 nsIURI
* docURI
= document
->GetDocumentURI();
1402 nsresult rv
= docURI
->GetSpec(spec
);
1403 if (NS_FAILED(rv
)) {
1407 CopyUTF8toUTF16(spec
, aValue
);
1410 GetURIAttr(nsGkAtoms::action
, nullptr, aValue
);
1414 nsresult
HTMLFormElement::GetActionURL(nsIURI
** aActionURL
,
1415 Element
* aOriginatingElement
) {
1416 nsresult rv
= NS_OK
;
1418 *aActionURL
= nullptr;
1421 // Grab the URL string
1423 // If the originating element is a submit control and has the formaction
1424 // attribute specified, it should be used. Otherwise, the action attribute
1425 // from the form element should be used.
1427 nsAutoString action
;
1429 if (aOriginatingElement
&&
1430 aOriginatingElement
->HasAttr(kNameSpaceID_None
, nsGkAtoms::formaction
)) {
1432 nsCOMPtr
<nsIFormControl
> formControl
=
1433 do_QueryInterface(aOriginatingElement
);
1434 NS_ASSERTION(formControl
&& formControl
->IsSubmitControl(),
1435 "The originating element must be a submit form control!");
1438 HTMLInputElement
* inputElement
=
1439 HTMLInputElement::FromNode(aOriginatingElement
);
1441 inputElement
->GetFormAction(action
);
1443 auto buttonElement
= HTMLButtonElement::FromNode(aOriginatingElement
);
1444 if (buttonElement
) {
1445 buttonElement
->GetFormAction(action
);
1447 NS_ERROR("Originating element must be an input or button element!");
1448 return NS_ERROR_UNEXPECTED
;
1456 // Form the full action URL
1459 // Get the document to form the URL.
1460 // We'll also need it later to get the DOM window when notifying form submit
1461 // observers (bug 33203)
1462 if (!IsInComposedDoc()) {
1463 return NS_OK
; // No doc means don't submit, see Bug 28988
1467 Document
* document
= OwnerDoc();
1468 nsIURI
* docURI
= document
->GetDocumentURI();
1469 NS_ENSURE_TRUE(docURI
, NS_ERROR_UNEXPECTED
);
1471 // If an action is not specified and we are inside
1472 // a HTML document then reload the URL. This makes us
1473 // compatible with 4.x browsers.
1474 // If we are in some other type of document such as XML or
1475 // XUL, do nothing. This prevents undesirable reloading of
1476 // a document inside XUL.
1478 nsCOMPtr
<nsIURI
> actionURL
;
1479 if (action
.IsEmpty()) {
1480 if (!document
->IsHTMLOrXHTML()) {
1481 // Must be a XML, XUL or other non-HTML document type
1488 nsIURI
* baseURL
= GetBaseURI();
1489 NS_ASSERTION(baseURL
, "No Base URL found in Form Submit!\n");
1491 return NS_OK
; // No base URL -> exit early, see Bug 30721
1493 rv
= NS_NewURI(getter_AddRefs(actionURL
), action
, nullptr, baseURL
);
1494 NS_ENSURE_SUCCESS(rv
, rv
);
1498 // Verify the URL should be reached
1500 // Get security manager, check to see if access to action URI is allowed.
1502 nsIScriptSecurityManager
* securityManager
=
1503 nsContentUtils::GetSecurityManager();
1504 rv
= securityManager
->CheckLoadURIWithPrincipal(
1505 NodePrincipal(), actionURL
, nsIScriptSecurityManager::STANDARD
);
1506 NS_ENSURE_SUCCESS(rv
, rv
);
1508 // Potentially the page uses the CSP directive 'upgrade-insecure-requests'. In
1509 // such a case we have to upgrade the action url from http:// to https://.
1510 // If the actionURL is not http, then there is nothing to do.
1511 bool isHttpScheme
= false;
1512 rv
= actionURL
->SchemeIs("http", &isHttpScheme
);
1513 NS_ENSURE_SUCCESS(rv
, rv
);
1514 if (isHttpScheme
&& document
->GetUpgradeInsecureRequests(false)) {
1515 // let's use the old specification before the upgrade for logging
1516 AutoTArray
<nsString
, 2> params
;
1518 rv
= actionURL
->GetSpec(spec
);
1519 NS_ENSURE_SUCCESS(rv
, rv
);
1520 CopyUTF8toUTF16(spec
, *params
.AppendElement());
1522 // upgrade the actionURL from http:// to use https://
1523 nsCOMPtr
<nsIURI
> upgradedActionURL
;
1524 rv
= NS_GetSecureUpgradedURI(actionURL
, getter_AddRefs(upgradedActionURL
));
1525 NS_ENSURE_SUCCESS(rv
, rv
);
1526 actionURL
= upgradedActionURL
.forget();
1528 // let's log a message to the console that we are upgrading a request
1529 nsAutoCString scheme
;
1530 rv
= actionURL
->GetScheme(scheme
);
1531 NS_ENSURE_SUCCESS(rv
, rv
);
1532 CopyUTF8toUTF16(scheme
, *params
.AppendElement());
1534 CSP_LogLocalizedStr(
1535 "upgradeInsecureRequest", params
,
1536 EmptyString(), // aSourceFile
1537 EmptyString(), // aScriptSample
1540 nsIScriptError::warningFlag
,
1541 NS_LITERAL_CSTRING("upgradeInsecureRequest"), document
->InnerWindowID(),
1542 !!document
->NodePrincipal()->OriginAttributesRef().mPrivateBrowsingId
);
1546 // Assign to the output
1548 actionURL
.forget(aActionURL
);
1553 NS_IMETHODIMP_(nsIFormControl
*)
1554 HTMLFormElement::GetDefaultSubmitElement() const {
1555 MOZ_ASSERT(mDefaultSubmitElement
== mFirstSubmitInElements
||
1556 mDefaultSubmitElement
== mFirstSubmitNotInElements
,
1557 "What happened here?");
1559 return mDefaultSubmitElement
;
1562 bool HTMLFormElement::IsDefaultSubmitElement(
1563 const nsIFormControl
* aControl
) const {
1564 MOZ_ASSERT(aControl
, "Unexpected call");
1566 if (aControl
== mDefaultSubmitElement
) {
1571 if (mDefaultSubmitElement
|| (aControl
!= mFirstSubmitInElements
&&
1572 aControl
!= mFirstSubmitNotInElements
)) {
1577 // mDefaultSubmitElement is null, but we have a non-null submit around
1578 // (aControl, in fact). figure out whether it's in fact the default submit
1579 // and just hasn't been set that way yet. Note that we can't just call
1580 // HandleDefaultSubmitRemoval because we might need to notify to handle that
1581 // correctly and we don't know whether that's safe right here.
1582 if (!mFirstSubmitInElements
|| !mFirstSubmitNotInElements
) {
1583 // We only have one first submit; aControl has to be it
1587 // We have both kinds of submits. Check which comes first.
1588 nsIFormControl
* defaultSubmit
=
1589 CompareFormControlPosition(mFirstSubmitInElements
,
1590 mFirstSubmitNotInElements
, this) < 0
1591 ? mFirstSubmitInElements
1592 : mFirstSubmitNotInElements
;
1593 return aControl
== defaultSubmit
;
1596 bool HTMLFormElement::ImplicitSubmissionIsDisabled() const {
1597 // Input text controls are always in the elements list.
1598 uint32_t numDisablingControlsFound
= 0;
1599 uint32_t length
= mControls
->mElements
.Length();
1600 for (uint32_t i
= 0; i
< length
&& numDisablingControlsFound
< 2; ++i
) {
1601 if (mControls
->mElements
[i
]->IsSingleLineTextOrNumberControl(false)) {
1602 numDisablingControlsFound
++;
1605 return numDisablingControlsFound
!= 1;
1608 bool HTMLFormElement::IsLastActiveElement(
1609 const nsIFormControl
* aControl
) const {
1610 MOZ_ASSERT(aControl
, "Unexpected call");
1612 for (auto* element
: Reversed(mControls
->mElements
)) {
1613 // XXX How about date/time control?
1614 if (element
->IsTextOrNumberControl(false) && !element
->IsDisabled()) {
1615 return element
== aControl
;
1621 int32_t HTMLFormElement::Length() { return mControls
->Length(); }
1623 void HTMLFormElement::ForgetCurrentSubmission() {
1624 mNotifiedObservers
= false;
1625 mIsSubmitting
= false;
1626 mSubmittingRequest
= nullptr;
1627 nsCOMPtr
<nsIWebProgress
> webProgress
= do_QueryReferent(mWebProgress
);
1629 webProgress
->RemoveProgressListener(this);
1631 mWebProgress
= nullptr;
1634 bool HTMLFormElement::CheckFormValidity(
1635 nsTArray
<RefPtr
<Element
>>* aInvalidElements
) const {
1638 // This shouldn't be called recursively, so use a rather large value
1639 // for the preallocated buffer.
1640 AutoTArray
<RefPtr
<nsGenericHTMLFormElement
>, 100> sortedControls
;
1641 if (NS_FAILED(mControls
->GetSortedControls(sortedControls
))) {
1645 uint32_t len
= sortedControls
.Length();
1647 for (uint32_t i
= 0; i
< len
; ++i
) {
1648 nsCOMPtr
<nsIConstraintValidation
> cvElmt
=
1649 do_QueryObject(sortedControls
[i
]);
1650 if (cvElmt
&& cvElmt
->IsCandidateForConstraintValidation() &&
1651 !cvElmt
->IsValid()) {
1653 bool defaultAction
= true;
1654 nsContentUtils::DispatchTrustedEvent(
1655 sortedControls
[i
]->OwnerDoc(),
1656 static_cast<nsIContent
*>(sortedControls
[i
]),
1657 NS_LITERAL_STRING("invalid"), CanBubble::eNo
, Cancelable::eYes
,
1660 // Add all unhandled invalid controls to aInvalidElements if the caller
1662 if (defaultAction
&& aInvalidElements
) {
1663 aInvalidElements
->AppendElement(sortedControls
[i
]);
1671 bool HTMLFormElement::CheckValidFormSubmission() {
1673 * Check for form validity: do not submit a form if there are unhandled
1674 * invalid controls in the form.
1675 * This should not be done if the form has been submitted with .submit().
1677 * NOTE: for the moment, we are also checking that there is an observer for
1678 * NS_INVALIDFORMSUBMIT_SUBJECT so it will prevent blocking form submission
1679 * if the browser does not have implemented a UI yet.
1681 * TODO: the check for observer should be removed later when HTML5 Forms will
1682 * be spread enough and authors will assume forms can't be submitted when
1683 * invalid. See bug 587671.
1686 NS_ASSERTION(!HasAttr(kNameSpaceID_None
, nsGkAtoms::novalidate
),
1687 "We shouldn't be there if novalidate is set!");
1689 // When .submit() is called aEvent = nullptr so we can rely on that to know if
1690 // we have to check the validity of the form.
1691 nsCOMPtr
<nsIObserverService
> service
=
1692 mozilla::services::GetObserverService();
1694 NS_WARNING("No observer service available!");
1698 AutoTArray
<RefPtr
<Element
>, 32> invalidElements
;
1699 if (CheckFormValidity(&invalidElements
)) {
1703 // For the first invalid submission, we should update element states.
1704 // We have to do that _before_ calling the observers so we are sure they
1705 // will not interfere (like focusing the element).
1706 if (!mEverTriedInvalidSubmit
) {
1707 mEverTriedInvalidSubmit
= true;
1710 * We are going to call update states assuming elements want to
1711 * be notified because we can't know.
1712 * Submissions shouldn't happen during parsing so it _should_ be safe.
1715 nsAutoScriptBlocker scriptBlocker
;
1717 for (uint32_t i
= 0, length
= mControls
->mElements
.Length(); i
< length
;
1719 // Input elements can trigger a form submission and we want to
1720 // update the style in that case.
1721 if (mControls
->mElements
[i
]->IsHTMLElement(nsGkAtoms::input
) &&
1722 // We don't use nsContentUtils::IsFocusedContent here, because it
1723 // doesn't really do what we want for number controls: it's true
1724 // for the anonymous textnode inside, but not the number control
1725 // itself. We can use the focus state, though, because that gets
1726 // synced to the number control by the anonymous text control.
1727 mControls
->mElements
[i
]->State().HasState(NS_EVENT_STATE_FOCUS
)) {
1728 static_cast<HTMLInputElement
*>(mControls
->mElements
[i
])
1729 ->UpdateValidityUIBits(true);
1732 mControls
->mElements
[i
]->UpdateState(true);
1735 // Because of backward compatibility, <input type='image'> is not in
1736 // elements but can be invalid.
1737 // TODO: should probably be removed when bug 606491 will be fixed.
1738 for (uint32_t i
= 0, length
= mControls
->mNotInElements
.Length();
1740 mControls
->mNotInElements
[i
]->UpdateState(true);
1745 if (!jsapi
.Init(GetOwnerGlobal())) {
1748 JS::Rooted
<JS::Value
> detail(jsapi
.cx());
1749 if (!ToJSValue(jsapi
.cx(), invalidElements
, &detail
)) {
1753 RefPtr
<CustomEvent
> event
=
1754 NS_NewDOMCustomEvent(OwnerDoc(), nullptr, nullptr);
1755 event
->InitCustomEvent(jsapi
.cx(), NS_LITERAL_STRING("MozInvalidForm"),
1756 /* CanBubble */ true,
1757 /* Cancelable */ true, detail
);
1758 event
->SetTrusted(true);
1759 event
->WidgetEventPtr()->mFlags
.mOnlyChromeDispatch
= true;
1761 DispatchEvent(*event
);
1763 bool result
= !event
->DefaultPrevented();
1765 nsCOMPtr
<nsISimpleEnumerator
> theEnum
;
1766 nsresult rv
= service
->EnumerateObservers(NS_INVALIDFORMSUBMIT_SUBJECT
,
1767 getter_AddRefs(theEnum
));
1768 NS_ENSURE_SUCCESS(rv
, result
);
1770 bool hasObserver
= false;
1771 rv
= theEnum
->HasMoreElements(&hasObserver
);
1773 if (NS_SUCCEEDED(rv
) && hasObserver
) {
1776 nsCOMPtr
<nsISupports
> inst
;
1777 nsCOMPtr
<nsIFormSubmitObserver
> observer
;
1779 while (NS_SUCCEEDED(theEnum
->HasMoreElements(&more
)) && more
) {
1780 theEnum
->GetNext(getter_AddRefs(inst
));
1781 observer
= do_QueryInterface(inst
);
1784 observer
->NotifyInvalidSubmit(this, invalidElements
);
1791 "There is no observer for \"invalidformsubmit\". \
1792 One should be implemented!");
1798 bool HTMLFormElement::SubmissionCanProceed(Element
* aSubmitter
) {
1801 nsCOMPtr
<nsIFormControl
> fc
= do_QueryInterface(aSubmitter
);
1804 uint32_t type
= fc
->ControlType();
1805 MOZ_ASSERT(type
== NS_FORM_INPUT_SUBMIT
|| type
== NS_FORM_INPUT_IMAGE
||
1806 type
== NS_FORM_BUTTON_SUBMIT
,
1807 "aSubmitter is not a submit control?");
1811 // Modified step 2 of
1812 // https://html.spec.whatwg.org/multipage/forms.html#concept-form-submit --
1813 // we're not checking whether the node document is disconnected yet...
1814 if (OwnerDoc()->GetSandboxFlags() & SANDBOXED_FORMS
) {
1818 if (HasAttr(kNameSpaceID_None
, nsGkAtoms::novalidate
)) {
1823 aSubmitter
->HasAttr(kNameSpaceID_None
, nsGkAtoms::formnovalidate
)) {
1827 return CheckValidFormSubmission();
1830 void HTMLFormElement::UpdateValidity(bool aElementValidity
) {
1831 if (aElementValidity
) {
1832 --mInvalidElementsCount
;
1834 ++mInvalidElementsCount
;
1837 NS_ASSERTION(mInvalidElementsCount
>= 0, "Something went seriously wrong!");
1839 // The form validity has just changed if:
1840 // - there are no more invalid elements ;
1841 // - or there is one invalid elmement and an element just became invalid.
1842 // If we have invalid elements and we used to before as well, do nothing.
1843 if (mInvalidElementsCount
&&
1844 (mInvalidElementsCount
!= 1 || aElementValidity
)) {
1849 * We are going to update states assuming submit controls want to
1850 * be notified because we can't know.
1851 * UpdateValidity shouldn't be called so much during parsing so it _should_
1855 nsAutoScriptBlocker scriptBlocker
;
1857 // Inform submit controls that the form validity has changed.
1858 for (uint32_t i
= 0, length
= mControls
->mElements
.Length(); i
< length
;
1860 if (mControls
->mElements
[i
]->IsSubmitControl()) {
1861 mControls
->mElements
[i
]->UpdateState(true);
1865 // Because of backward compatibility, <input type='image'> is not in elements
1866 // so we have to check for controls not in elements too.
1867 uint32_t length
= mControls
->mNotInElements
.Length();
1868 for (uint32_t i
= 0; i
< length
; ++i
) {
1869 if (mControls
->mNotInElements
[i
]->IsSubmitControl()) {
1870 mControls
->mNotInElements
[i
]->UpdateState(true);
1877 // nsIWebProgressListener
1879 HTMLFormElement::OnStateChange(nsIWebProgress
* aWebProgress
,
1880 nsIRequest
* aRequest
, uint32_t aStateFlags
,
1882 // If STATE_STOP is never fired for any reason (redirect? Failed state
1883 // change?) the form element will leak. It will be kept around by the
1884 // nsIWebProgressListener (assuming it keeps a strong pointer). We will
1885 // consequently leak the request.
1886 if (aRequest
== mSubmittingRequest
&&
1887 aStateFlags
& nsIWebProgressListener::STATE_STOP
) {
1888 ForgetCurrentSubmission();
1895 HTMLFormElement::OnProgressChange(nsIWebProgress
* aWebProgress
,
1896 nsIRequest
* aRequest
,
1897 int32_t aCurSelfProgress
,
1898 int32_t aMaxSelfProgress
,
1899 int32_t aCurTotalProgress
,
1900 int32_t aMaxTotalProgress
) {
1901 MOZ_ASSERT_UNREACHABLE("notification excluded in AddProgressListener(...)");
1906 HTMLFormElement::OnLocationChange(nsIWebProgress
* aWebProgress
,
1907 nsIRequest
* aRequest
, nsIURI
* location
,
1909 MOZ_ASSERT_UNREACHABLE("notification excluded in AddProgressListener(...)");
1914 HTMLFormElement::OnStatusChange(nsIWebProgress
* aWebProgress
,
1915 nsIRequest
* aRequest
, nsresult aStatus
,
1916 const char16_t
* aMessage
) {
1917 MOZ_ASSERT_UNREACHABLE("notification excluded in AddProgressListener(...)");
1922 HTMLFormElement::OnSecurityChange(nsIWebProgress
* aWebProgress
,
1923 nsIRequest
* aRequest
, uint32_t aState
) {
1924 MOZ_ASSERT_UNREACHABLE("notification excluded in AddProgressListener(...)");
1929 HTMLFormElement::OnContentBlockingEvent(nsIWebProgress
* aWebProgress
,
1930 nsIRequest
* aRequest
, uint32_t aEvent
) {
1931 MOZ_ASSERT_UNREACHABLE("notification excluded in AddProgressListener(...)");
1935 NS_IMETHODIMP_(int32_t)
1936 HTMLFormElement::IndexOfControl(nsIFormControl
* aControl
) {
1938 return mControls
->IndexOfControl(aControl
, &index
) == NS_OK
? index
: 0;
1941 void HTMLFormElement::SetCurrentRadioButton(const nsAString
& aName
,
1942 HTMLInputElement
* aRadio
) {
1943 mSelectedRadioButtons
.Put(aName
, aRadio
);
1946 HTMLInputElement
* HTMLFormElement::GetCurrentRadioButton(
1947 const nsAString
& aName
) {
1948 return mSelectedRadioButtons
.GetWeak(aName
);
1952 HTMLFormElement::GetNextRadioButton(const nsAString
& aName
,
1953 const bool aPrevious
,
1954 HTMLInputElement
* aFocusedRadio
,
1955 HTMLInputElement
** aRadioOut
) {
1956 // Return the radio button relative to the focused radio button.
1957 // If no radio is focused, get the radio relative to the selected one.
1958 *aRadioOut
= nullptr;
1960 RefPtr
<HTMLInputElement
> currentRadio
;
1961 if (aFocusedRadio
) {
1962 currentRadio
= aFocusedRadio
;
1964 mSelectedRadioButtons
.Get(aName
, getter_AddRefs(currentRadio
));
1967 nsCOMPtr
<nsISupports
> itemWithName
= DoResolveName(aName
, true);
1968 nsCOMPtr
<nsINodeList
> radioGroup(do_QueryInterface(itemWithName
));
1971 return NS_ERROR_FAILURE
;
1974 int32_t index
= radioGroup
->IndexOf(currentRadio
);
1976 return NS_ERROR_FAILURE
;
1979 uint32_t numRadios
= radioGroup
->Length();
1980 RefPtr
<HTMLInputElement
> radio
;
1982 bool isRadio
= false;
1986 index
= numRadios
- 1;
1988 } else if (++index
>= (int32_t)numRadios
) {
1991 radio
= HTMLInputElement::FromNodeOrNull(radioGroup
->Item(index
));
1992 isRadio
= radio
&& radio
->ControlType() == NS_FORM_INPUT_RADIO
;
1998 radio
->GetName(name
);
1999 isRadio
= aName
.Equals(name
);
2000 } while (!isRadio
|| (radio
->Disabled() && radio
!= currentRadio
));
2002 NS_IF_ADDREF(*aRadioOut
= radio
);
2007 HTMLFormElement::WalkRadioGroup(const nsAString
& aName
,
2008 nsIRadioVisitor
* aVisitor
, bool aFlushContent
) {
2009 if (aName
.IsEmpty()) {
2011 // XXX If the name is empty, it's not stored in the control list. There
2012 // *must* be a more efficient way to do this.
2014 nsCOMPtr
<nsIFormControl
> control
;
2015 uint32_t len
= GetElementCount();
2016 for (uint32_t i
= 0; i
< len
; i
++) {
2017 control
= GetElementAt(i
);
2018 if (control
->ControlType() == NS_FORM_INPUT_RADIO
) {
2019 nsCOMPtr
<Element
> controlElement
= do_QueryInterface(control
);
2020 if (controlElement
&&
2021 controlElement
->AttrValueIs(kNameSpaceID_None
, nsGkAtoms::name
,
2022 EmptyString(), eCaseMatters
) &&
2023 !aVisitor
->Visit(control
)) {
2031 // Get the control / list of controls from the form using form["name"]
2032 nsCOMPtr
<nsISupports
> item
= DoResolveName(aName
, aFlushContent
);
2034 return NS_ERROR_FAILURE
;
2037 // If it's just a lone radio button, then select it.
2038 nsCOMPtr
<nsIFormControl
> formControl
= do_QueryInterface(item
);
2040 if (formControl
->ControlType() == NS_FORM_INPUT_RADIO
) {
2041 aVisitor
->Visit(formControl
);
2046 nsCOMPtr
<nsINodeList
> nodeList
= do_QueryInterface(item
);
2050 uint32_t length
= nodeList
->Length();
2051 for (uint32_t i
= 0; i
< length
; i
++) {
2052 nsIContent
* node
= nodeList
->Item(i
);
2053 nsCOMPtr
<nsIFormControl
> formControl
= do_QueryInterface(node
);
2054 if (formControl
&& formControl
->ControlType() == NS_FORM_INPUT_RADIO
&&
2055 !aVisitor
->Visit(formControl
)) {
2062 void HTMLFormElement::AddToRadioGroup(const nsAString
& aName
,
2063 HTMLInputElement
* aRadio
) {
2064 if (aRadio
->IsRequired()) {
2065 auto entry
= mRequiredRadioButtonCounts
.LookupForAdd(aName
);
2067 entry
.OrInsert([]() { return 1; });
2074 void HTMLFormElement::RemoveFromRadioGroup(const nsAString
& aName
,
2075 HTMLInputElement
* aRadio
) {
2076 if (aRadio
->IsRequired()) {
2077 auto entry
= mRequiredRadioButtonCounts
.Lookup(aName
);
2079 MOZ_ASSERT_UNREACHABLE("At least one radio button has to be required!");
2081 MOZ_ASSERT(entry
.Data() >= 1,
2082 "At least one radio button has to be required!");
2083 if (entry
.Data() <= 1) {
2092 uint32_t HTMLFormElement::GetRequiredRadioCount(const nsAString
& aName
) const {
2093 return mRequiredRadioButtonCounts
.Get(aName
);
2096 void HTMLFormElement::RadioRequiredWillChange(const nsAString
& aName
,
2097 bool aRequiredAdded
) {
2098 if (aRequiredAdded
) {
2099 mRequiredRadioButtonCounts
.Put(aName
,
2100 mRequiredRadioButtonCounts
.Get(aName
) + 1);
2102 uint32_t requiredNb
= mRequiredRadioButtonCounts
.Get(aName
);
2103 NS_ASSERTION(requiredNb
>= 1,
2104 "At least one radio button has to be required!");
2105 if (requiredNb
== 1) {
2106 mRequiredRadioButtonCounts
.Remove(aName
);
2108 mRequiredRadioButtonCounts
.Put(aName
, requiredNb
- 1);
2113 bool HTMLFormElement::GetValueMissingState(const nsAString
& aName
) const {
2114 return mValueMissingRadioGroups
.Get(aName
);
2117 void HTMLFormElement::SetValueMissingState(const nsAString
& aName
,
2119 mValueMissingRadioGroups
.Put(aName
, aValue
);
2122 EventStates
HTMLFormElement::IntrinsicState() const {
2123 EventStates state
= nsGenericHTMLElement::IntrinsicState();
2125 if (mInvalidElementsCount
) {
2126 state
|= NS_EVENT_STATE_INVALID
;
2128 state
|= NS_EVENT_STATE_VALID
;
2134 void HTMLFormElement::Clear() {
2135 for (int32_t i
= mImageElements
.Length() - 1; i
>= 0; i
--) {
2136 mImageElements
[i
]->ClearForm(false);
2138 mImageElements
.Clear();
2139 mImageNameLookupTable
.Clear();
2140 mPastNameLookupTable
.Clear();
2145 struct PositionComparator
{
2146 nsIContent
* const mElement
;
2147 explicit PositionComparator(nsIContent
* const aElement
)
2148 : mElement(aElement
) {}
2150 int operator()(nsIContent
* aElement
) const {
2151 if (mElement
== aElement
) {
2154 if (nsContentUtils::PositionIsBefore(mElement
, aElement
)) {
2161 struct RadioNodeListAdaptor
{
2162 RadioNodeList
* const mList
;
2163 explicit RadioNodeListAdaptor(RadioNodeList
* aList
) : mList(aList
) {}
2164 nsIContent
* operator[](size_t aIdx
) const { return mList
->Item(aIdx
); }
2169 nsresult
HTMLFormElement::AddElementToTableInternal(
2170 nsInterfaceHashtable
<nsStringHashKey
, nsISupports
>& aTable
,
2171 nsIContent
* aChild
, const nsAString
& aName
) {
2172 auto entry
= aTable
.LookupForAdd(aName
);
2174 // No entry found, add the element
2175 entry
.OrInsert([&aChild
]() { return aChild
; });
2176 ++mExpandoAndGeneration
.generation
;
2178 // Found something in the hash, check its type
2179 nsCOMPtr
<nsIContent
> content
= do_QueryInterface(entry
.Data());
2182 // Check if the new content is the same as the one we found in the
2183 // hash, if it is then we leave it in the hash as it is, this will
2184 // happen if a form control has both a name and an id with the same
2186 if (content
== aChild
) {
2190 // Found an element, create a list, add the element to the list and put
2191 // the list in the hash
2192 RadioNodeList
* list
= new RadioNodeList(this);
2194 // If an element has a @form, we can assume it *might* be able to not have
2195 // a parent and still be in the form.
2197 (content
->IsElement() &&
2198 content
->AsElement()->HasAttr(kNameSpaceID_None
, nsGkAtoms::form
)) ||
2199 content
->GetParent(),
2200 "Item in list without parent");
2202 // Determine the ordering between the new and old element.
2203 bool newFirst
= nsContentUtils::PositionIsBefore(aChild
, content
);
2205 list
->AppendElement(newFirst
? aChild
: content
.get());
2206 list
->AppendElement(newFirst
? content
.get() : aChild
);
2208 nsCOMPtr
<nsISupports
> listSupports
= do_QueryObject(list
);
2210 // Replace the element with the list.
2211 entry
.Data() = listSupports
;
2213 // There's already a list in the hash, add the child to the list.
2214 MOZ_ASSERT(nsCOMPtr
<RadioNodeList
>(do_QueryInterface(entry
.Data())));
2215 auto* list
= static_cast<RadioNodeList
*>(entry
.Data().get());
2217 NS_ASSERTION(list
->Length() > 1,
2218 "List should have been converted back to a single element");
2220 // Fast-path appends; this check is ok even if the child is
2221 // already in the list, since if it tests true the child would
2222 // have come at the end of the list, and the PositionIsBefore
2224 if (nsContentUtils::PositionIsBefore(list
->Item(list
->Length() - 1),
2226 list
->AppendElement(aChild
);
2230 // If a control has a name equal to its id, it could be in the
2232 if (list
->IndexOf(aChild
) != -1) {
2237 DebugOnly
<bool> found
=
2238 BinarySearchIf(RadioNodeListAdaptor(list
), 0, list
->Length(),
2239 PositionComparator(aChild
), &idx
);
2240 MOZ_ASSERT(!found
, "should not have found an element");
2242 list
->InsertElementAt(aChild
, idx
);
2249 nsresult
HTMLFormElement::AddImageElement(HTMLImageElement
* aChild
) {
2250 AddElementToList(mImageElements
, aChild
, this);
2254 nsresult
HTMLFormElement::AddImageElementToTable(HTMLImageElement
* aChild
,
2255 const nsAString
& aName
) {
2256 return AddElementToTableInternal(mImageNameLookupTable
, aChild
, aName
);
2259 nsresult
HTMLFormElement::RemoveImageElement(HTMLImageElement
* aChild
) {
2260 RemoveElementFromPastNamesMap(aChild
);
2262 size_t index
= mImageElements
.IndexOf(aChild
);
2263 NS_ENSURE_STATE(index
!= mImageElements
.NoIndex
);
2265 mImageElements
.RemoveElementAt(index
);
2269 nsresult
HTMLFormElement::RemoveImageElementFromTable(
2270 HTMLImageElement
* aElement
, const nsAString
& aName
) {
2271 return RemoveElementFromTableInternal(mImageNameLookupTable
, aElement
, aName
);
2274 void HTMLFormElement::AddToPastNamesMap(const nsAString
& aName
,
2275 nsISupports
* aChild
) {
2276 // If candidates contains exactly one node. Add a mapping from name to the
2277 // node in candidates in the form element's past names map, replacing the
2278 // previous entry with the same name, if any.
2279 nsCOMPtr
<nsIContent
> node
= do_QueryInterface(aChild
);
2281 mPastNameLookupTable
.Put(aName
, node
);
2282 node
->SetFlags(MAY_BE_IN_PAST_NAMES_MAP
);
2286 void HTMLFormElement::RemoveElementFromPastNamesMap(Element
* aElement
) {
2287 if (!aElement
->HasFlag(MAY_BE_IN_PAST_NAMES_MAP
)) {
2291 aElement
->UnsetFlags(MAY_BE_IN_PAST_NAMES_MAP
);
2293 uint32_t oldCount
= mPastNameLookupTable
.Count();
2294 for (auto iter
= mPastNameLookupTable
.Iter(); !iter
.Done(); iter
.Next()) {
2295 if (aElement
== iter
.Data()) {
2299 if (oldCount
!= mPastNameLookupTable
.Count()) {
2300 ++mExpandoAndGeneration
.generation
;
2304 JSObject
* HTMLFormElement::WrapNode(JSContext
* aCx
,
2305 JS::Handle
<JSObject
*> aGivenProto
) {
2306 return HTMLFormElement_Binding::Wrap(aCx
, this, aGivenProto
);
2309 int32_t HTMLFormElement::GetFormNumberForStateKey() {
2310 if (mFormNumber
== -1) {
2311 mFormNumber
= OwnerDoc()->GetNextFormNumber();
2316 void HTMLFormElement::NodeInfoChanged(Document
* aOldDoc
) {
2317 nsGenericHTMLElement::NodeInfoChanged(aOldDoc
);
2319 // When a <form> element is adopted into a new document, we want any state
2320 // keys generated from it to no longer consider this element to be parser
2321 // inserted, and so have state keys based on the position of the <form>
2322 // element in the document, rather than the order it was inserted in.
2324 // This is not strictly necessary, since we only ever look at the form number
2325 // for parser inserted form controls, and we do that at the time the form
2326 // control element is inserted into its original document by the parser.
2331 } // namespace mozilla