/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ /* vim: set ts=8 sts=2 et sw=2 tw=80: */ /* This Source Code Form is subject to the terms of the Mozilla Public * License, v. 2.0. If a copy of the MPL was not distributed with this * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ #include "mozilla/dom/HTMLFormElement.h" #include "jsapi.h" #include "mozilla/ContentEvents.h" #include "mozilla/EventDispatcher.h" #include "mozilla/EventStateManager.h" #include "mozilla/EventStates.h" #include "mozilla/dom/AutocompleteErrorEvent.h" #include "mozilla/dom/nsCSPUtils.h" #include "mozilla/dom/nsCSPContext.h" #include "mozilla/dom/HTMLFormControlsCollection.h" #include "mozilla/dom/HTMLFormElementBinding.h" #include "mozilla/Move.h" #include "nsIHTMLDocument.h" #include "nsGkAtoms.h" #include "nsStyleConsts.h" #include "nsPresContext.h" #include "nsIDocument.h" #include "nsIFormControlFrame.h" #include "nsError.h" #include "nsContentUtils.h" #include "nsInterfaceHashtable.h" #include "nsContentList.h" #include "nsCOMArray.h" #include "nsAutoPtr.h" #include "nsTArray.h" #include "nsIMutableArray.h" #include "nsIFormAutofillContentService.h" #include "mozilla/BinarySearch.h" #include "nsQueryObject.h" // form submission #include "HTMLFormSubmissionConstants.h" #include "mozilla/dom/FormData.h" #include "mozilla/Telemetry.h" #include "nsIFormSubmitObserver.h" #include "nsIObserverService.h" #include "nsICategoryManager.h" #include "nsCategoryManagerUtils.h" #include "nsISimpleEnumerator.h" #include "nsRange.h" #include "nsIScriptError.h" #include "nsIScriptSecurityManager.h" #include "nsNetUtil.h" #include "nsIInterfaceRequestorUtils.h" #include "nsIWebProgress.h" #include "nsIDocShell.h" #include "nsIPrompt.h" #include "nsISecurityUITelemetry.h" #include "nsIStringBundle.h" // radio buttons #include "mozilla/dom/HTMLInputElement.h" #include "nsIRadioVisitor.h" #include "RadioNodeList.h" #include "nsLayoutUtils.h" #include "mozAutoDocUpdate.h" #include "nsIHTMLCollection.h" #include "nsIConstraintValidation.h" #include "nsIDOMHTMLButtonElement.h" #include "nsSandboxFlags.h" #include "nsIContentSecurityPolicy.h" // images #include "mozilla/dom/HTMLImageElement.h" // construction, destruction NS_IMPL_NS_NEW_HTML_ELEMENT(Form) namespace mozilla { namespace dom { static const uint8_t NS_FORM_AUTOCOMPLETE_ON = 1; static const uint8_t NS_FORM_AUTOCOMPLETE_OFF = 0; static const nsAttrValue::EnumTable kFormAutocompleteTable[] = { { "on", NS_FORM_AUTOCOMPLETE_ON }, { "off", NS_FORM_AUTOCOMPLETE_OFF }, { nullptr, 0 } }; // Default autocomplete value is 'on'. static const nsAttrValue::EnumTable* kFormDefaultAutocomplete = &kFormAutocompleteTable[0]; bool HTMLFormElement::gFirstFormSubmitted = false; bool HTMLFormElement::gPasswordManagerInitialized = false; HTMLFormElement::HTMLFormElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo) : nsGenericHTMLElement(aNodeInfo), mControls(new HTMLFormControlsCollection(this)), mSelectedRadioButtons(2), mRequiredRadioButtonCounts(2), mValueMissingRadioGroups(2), mGeneratingSubmit(false), mGeneratingReset(false), mIsSubmitting(false), mDeferSubmission(false), mNotifiedObservers(false), mNotifiedObserversResult(false), mSubmitPopupState(openAbused), mSubmitInitiatedFromUserInput(false), mPendingSubmission(nullptr), mSubmittingRequest(nullptr), mDefaultSubmitElement(nullptr), mFirstSubmitInElements(nullptr), mFirstSubmitNotInElements(nullptr), mImageNameLookupTable(FORM_CONTROL_LIST_HASHTABLE_LENGTH), mPastNameLookupTable(FORM_CONTROL_LIST_HASHTABLE_LENGTH), mInvalidElementsCount(0), mEverTriedInvalidSubmit(false) { // We start out valid. AddStatesSilently(NS_EVENT_STATE_VALID); } HTMLFormElement::~HTMLFormElement() { if (mControls) { mControls->DropFormReference(); } Clear(); } // nsISupports NS_IMPL_CYCLE_COLLECTION_CLASS(HTMLFormElement) NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(HTMLFormElement, nsGenericHTMLElement) NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mControls) NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mImageNameLookupTable) NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mPastNameLookupTable) NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mSelectedRadioButtons) NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(HTMLFormElement, nsGenericHTMLElement) tmp->Clear(); tmp->mExpandoAndGeneration.OwnerUnlinked(); NS_IMPL_CYCLE_COLLECTION_UNLINK_END NS_IMPL_ADDREF_INHERITED(HTMLFormElement, Element) NS_IMPL_RELEASE_INHERITED(HTMLFormElement, Element) // QueryInterface implementation for HTMLFormElement NS_INTERFACE_TABLE_HEAD_CYCLE_COLLECTION_INHERITED(HTMLFormElement) NS_INTERFACE_TABLE_INHERITED(HTMLFormElement, nsIDOMHTMLFormElement, nsIForm, nsIWebProgressListener, nsIRadioGroupContainer) NS_INTERFACE_TABLE_TAIL_INHERITING(nsGenericHTMLElement) // EventTarget void HTMLFormElement::AsyncEventRunning(AsyncEventDispatcher* aEvent) { if (mFormPasswordEventDispatcher == aEvent) { mFormPasswordEventDispatcher = nullptr; } } // nsIDOMHTMLFormElement NS_IMPL_ELEMENT_CLONE(HTMLFormElement) nsIHTMLCollection* HTMLFormElement::Elements() { return mControls; } NS_IMETHODIMP HTMLFormElement::GetElements(nsIDOMHTMLCollection** aElements) { *aElements = Elements(); NS_ADDREF(*aElements); return NS_OK; } nsresult HTMLFormElement::SetAttr(int32_t aNameSpaceID, nsIAtom* aName, nsIAtom* aPrefix, const nsAString& aValue, bool aNotify) { if ((aName == nsGkAtoms::action || aName == nsGkAtoms::target) && aNameSpaceID == kNameSpaceID_None) { if (mPendingSubmission) { // aha, there is a pending submission that means we're in // the script and we need to flush it. let's tell it // that the event was ignored to force the flush. // the second argument is not playing a role at all. FlushPendingSubmission(); } // Don't forget we've notified the password manager already if the // page sets the action/target in the during submit. (bug 343182) bool notifiedObservers = mNotifiedObservers; ForgetCurrentSubmission(); mNotifiedObservers = notifiedObservers; } return nsGenericHTMLElement::SetAttr(aNameSpaceID, aName, aPrefix, aValue, aNotify); } nsresult HTMLFormElement::AfterSetAttr(int32_t aNameSpaceID, nsIAtom* aName, const nsAttrValue* aValue, bool aNotify) { if (aName == nsGkAtoms::novalidate && aNameSpaceID == kNameSpaceID_None) { // Update all form elements states because they might be [no longer] // affected by :-moz-ui-valid or :-moz-ui-invalid. for (uint32_t i = 0, length = mControls->mElements.Length(); i < length; ++i) { mControls->mElements[i]->UpdateState(true); } for (uint32_t i = 0, length = mControls->mNotInElements.Length(); i < length; ++i) { mControls->mNotInElements[i]->UpdateState(true); } } return nsGenericHTMLElement::AfterSetAttr(aNameSpaceID, aName, aValue, aNotify); } NS_IMPL_STRING_ATTR(HTMLFormElement, AcceptCharset, acceptcharset) NS_IMPL_ACTION_ATTR(HTMLFormElement, Action, action) NS_IMPL_ENUM_ATTR_DEFAULT_VALUE(HTMLFormElement, Autocomplete, autocomplete, kFormDefaultAutocomplete->tag) NS_IMPL_ENUM_ATTR_DEFAULT_VALUE(HTMLFormElement, Enctype, enctype, kFormDefaultEnctype->tag) NS_IMPL_ENUM_ATTR_DEFAULT_VALUE(HTMLFormElement, Method, method, kFormDefaultMethod->tag) NS_IMPL_BOOL_ATTR(HTMLFormElement, NoValidate, novalidate) NS_IMPL_STRING_ATTR(HTMLFormElement, Name, name) NS_IMPL_STRING_ATTR(HTMLFormElement, Target, target) void HTMLFormElement::Submit(ErrorResult& aRv) { // Send the submit event if (mPendingSubmission) { // aha, we have a pending submission that was not flushed // (this happens when form.submit() is called twice) // we have to delete it and build a new one since values // might have changed inbetween (we emulate IE here, that's all) mPendingSubmission = nullptr; } aRv = DoSubmitOrReset(nullptr, eFormSubmit); } NS_IMETHODIMP HTMLFormElement::Submit() { ErrorResult rv; Submit(rv); return rv.StealNSResult(); } NS_IMETHODIMP HTMLFormElement::Reset() { InternalFormEvent event(true, eFormReset); EventDispatcher::Dispatch(static_cast<nsIContent*>(this), nullptr, &event); return NS_OK; } NS_IMETHODIMP HTMLFormElement::CheckValidity(bool* retVal) { *retVal = CheckValidity(); return NS_OK; } void HTMLFormElement::RequestAutocomplete() { bool dummy; nsCOMPtr<nsIDOMWindow> window = do_QueryInterface(OwnerDoc()->GetScriptHandlingObject(dummy)); nsCOMPtr<nsIFormAutofillContentService> formAutofillContentService = do_GetService("@mozilla.org/formautofill/content-service;1"); if (!formAutofillContentService || !window) { AutocompleteErrorEventInit init; init.mBubbles = true; init.mCancelable = false; init.mReason = AutoCompleteErrorReason::Disabled; RefPtr<AutocompleteErrorEvent> event = AutocompleteErrorEvent::Constructor(this, NS_LITERAL_STRING("autocompleteerror"), init); (new AsyncEventDispatcher(this, event))->PostDOMEvent(); return; } formAutofillContentService->RequestAutocomplete(this, window); } bool HTMLFormElement::ParseAttribute(int32_t aNamespaceID, nsIAtom* aAttribute, const nsAString& aValue, nsAttrValue& aResult) { if (aNamespaceID == kNameSpaceID_None) { if (aAttribute == nsGkAtoms::method) { return aResult.ParseEnumValue(aValue, kFormMethodTable, false); } if (aAttribute == nsGkAtoms::enctype) { return aResult.ParseEnumValue(aValue, kFormEnctypeTable, false); } if (aAttribute == nsGkAtoms::autocomplete) { return aResult.ParseEnumValue(aValue, kFormAutocompleteTable, false); } } return nsGenericHTMLElement::ParseAttribute(aNamespaceID, aAttribute, aValue, aResult); } nsresult HTMLFormElement::BindToTree(nsIDocument* aDocument, nsIContent* aParent, nsIContent* aBindingParent, bool aCompileEventHandlers) { nsresult rv = nsGenericHTMLElement::BindToTree(aDocument, aParent, aBindingParent, aCompileEventHandlers); NS_ENSURE_SUCCESS(rv, rv); nsCOMPtr<nsIHTMLDocument> htmlDoc(do_QueryInterface(aDocument)); if (htmlDoc) { htmlDoc->AddedForm(); } return rv; } template<typename T> static void MarkOrphans(const nsTArray<T*>& aArray) { uint32_t length = aArray.Length(); for (uint32_t i = 0; i < length; ++i) { aArray[i]->SetFlags(MAYBE_ORPHAN_FORM_ELEMENT); } } static void CollectOrphans(nsINode* aRemovalRoot, const nsTArray<nsGenericHTMLFormElement*>& aArray #ifdef DEBUG , nsIDOMHTMLFormElement* aThisForm #endif ) { // Put a script blocker around all the notifications we're about to do. nsAutoScriptBlocker scriptBlocker; // Walk backwards so that if we remove elements we can just keep iterating uint32_t length = aArray.Length(); for (uint32_t i = length; i > 0; --i) { nsGenericHTMLFormElement* node = aArray[i-1]; // Now if MAYBE_ORPHAN_FORM_ELEMENT is not set, that would mean that the // node is in fact a descendant of the form and hence should stay in the // form. If it _is_ set, then we need to check whether the node is a // descendant of aRemovalRoot. If it is, we leave it in the form. #ifdef DEBUG bool removed = false; #endif if (node->HasFlag(MAYBE_ORPHAN_FORM_ELEMENT)) { node->UnsetFlags(MAYBE_ORPHAN_FORM_ELEMENT); if (!nsContentUtils::ContentIsDescendantOf(node, aRemovalRoot)) { node->ClearForm(true); // When a form control loses its form owner, its state can change. node->UpdateState(true); #ifdef DEBUG removed = true; #endif } } #ifdef DEBUG if (!removed) { nsCOMPtr<nsIDOMHTMLFormElement> form; node->GetForm(getter_AddRefs(form)); NS_ASSERTION(form == aThisForm, "How did that happen?"); } #endif /* DEBUG */ } } static void CollectOrphans(nsINode* aRemovalRoot, const nsTArray<HTMLImageElement*>& aArray #ifdef DEBUG , nsIDOMHTMLFormElement* aThisForm #endif ) { // Walk backwards so that if we remove elements we can just keep iterating uint32_t length = aArray.Length(); for (uint32_t i = length; i > 0; --i) { HTMLImageElement* node = aArray[i-1]; // Now if MAYBE_ORPHAN_FORM_ELEMENT is not set, that would mean that the // node is in fact a descendant of the form and hence should stay in the // form. If it _is_ set, then we need to check whether the node is a // descendant of aRemovalRoot. If it is, we leave it in the form. #ifdef DEBUG bool removed = false; #endif if (node->HasFlag(MAYBE_ORPHAN_FORM_ELEMENT)) { node->UnsetFlags(MAYBE_ORPHAN_FORM_ELEMENT); if (!nsContentUtils::ContentIsDescendantOf(node, aRemovalRoot)) { node->ClearForm(true); #ifdef DEBUG removed = true; #endif } } #ifdef DEBUG if (!removed) { nsCOMPtr<nsIDOMHTMLFormElement> form = node->GetForm(); NS_ASSERTION(form == aThisForm, "How did that happen?"); } #endif /* DEBUG */ } } void HTMLFormElement::UnbindFromTree(bool aDeep, bool aNullParent) { nsCOMPtr<nsIHTMLDocument> oldDocument = do_QueryInterface(GetUncomposedDoc()); // Mark all of our controls as maybe being orphans MarkOrphans(mControls->mElements); MarkOrphans(mControls->mNotInElements); MarkOrphans(mImageElements); nsGenericHTMLElement::UnbindFromTree(aDeep, aNullParent); nsINode* ancestor = this; nsINode* cur; do { cur = ancestor->GetParentNode(); if (!cur) { break; } ancestor = cur; } while (1); CollectOrphans(ancestor, mControls->mElements #ifdef DEBUG , this #endif ); CollectOrphans(ancestor, mControls->mNotInElements #ifdef DEBUG , this #endif ); CollectOrphans(ancestor, mImageElements #ifdef DEBUG , this #endif ); if (oldDocument) { oldDocument->RemovedForm(); } ForgetCurrentSubmission(); } nsresult HTMLFormElement::PreHandleEvent(EventChainPreVisitor& aVisitor) { aVisitor.mWantsWillHandleEvent = true; if (aVisitor.mEvent->mOriginalTarget == static_cast<nsIContent*>(this)) { uint32_t msg = aVisitor.mEvent->mMessage; if (msg == eFormSubmit) { if (mGeneratingSubmit) { aVisitor.mCanHandle = false; return NS_OK; } mGeneratingSubmit = true; // let the form know that it needs to defer the submission, // that means that if there are scripted submissions, the // latest one will be deferred until after the exit point of the handler. mDeferSubmission = true; } else if (msg == eFormReset) { if (mGeneratingReset) { aVisitor.mCanHandle = false; return NS_OK; } mGeneratingReset = true; } } return nsGenericHTMLElement::PreHandleEvent(aVisitor); } nsresult HTMLFormElement::WillHandleEvent(EventChainPostVisitor& aVisitor) { // If this is the bubble stage and there is a nested form below us which // received a submit event we do *not* want to handle the submit event // for this form too. if ((aVisitor.mEvent->mMessage == eFormSubmit || aVisitor.mEvent->mMessage == eFormReset) && aVisitor.mEvent->mFlags.mInBubblingPhase && aVisitor.mEvent->mOriginalTarget != static_cast<nsIContent*>(this)) { aVisitor.mEvent->StopPropagation(); } return NS_OK; } nsresult HTMLFormElement::PostHandleEvent(EventChainPostVisitor& aVisitor) { if (aVisitor.mEvent->mOriginalTarget == static_cast<nsIContent*>(this)) { EventMessage msg = aVisitor.mEvent->mMessage; if (msg == eFormSubmit) { // let the form know not to defer subsequent submissions mDeferSubmission = false; } if (aVisitor.mEventStatus == nsEventStatus_eIgnore) { switch (msg) { case eFormReset: case eFormSubmit: { if (mPendingSubmission && msg == eFormSubmit) { // tell the form to forget a possible pending submission. // the reason is that the script returned true (the event was // ignored) so if there is a stored submission, it will miss // the name/value of the submitting element, thus we need // to forget it and the form element will build a new one mPendingSubmission = nullptr; } DoSubmitOrReset(aVisitor.mEvent, msg); break; } default: break; } } else { if (msg == eFormSubmit) { // tell the form to flush a possible pending submission. // the reason is that the script returned false (the event was // not ignored) so if there is a stored submission, it needs to // be submitted immediatelly. FlushPendingSubmission(); } } if (msg == eFormSubmit) { mGeneratingSubmit = false; } else if (msg == eFormReset) { mGeneratingReset = false; } } return NS_OK; } nsresult HTMLFormElement::DoSubmitOrReset(WidgetEvent* aEvent, EventMessage aMessage) { // Make sure the presentation is up-to-date nsIDocument* doc = GetComposedDoc(); if (doc) { doc->FlushPendingNotifications(Flush_ContentAndNotify); } // JBK Don't get form frames anymore - bug 34297 // Submit or Reset the form if (eFormReset == aMessage) { return DoReset(); } if (eFormSubmit == aMessage) { // Don't submit if we're not in a document or if we're in // a sandboxed frame and form submit is disabled. if (!doc || (doc->GetSandboxFlags() & SANDBOXED_FORMS)) { return NS_OK; } return DoSubmit(aEvent); } MOZ_ASSERT(false); return NS_OK; } nsresult HTMLFormElement::DoReset() { // JBK walk the elements[] array instead of form frame controls - bug 34297 uint32_t numElements = GetElementCount(); for (uint32_t elementX = 0; elementX < numElements; ++elementX) { // Hold strong ref in case the reset does something weird nsCOMPtr<nsIFormControl> controlNode = GetElementAt(elementX); if (controlNode) { controlNode->Reset(); } } return NS_OK; } #define NS_ENSURE_SUBMIT_SUCCESS(rv) \ if (NS_FAILED(rv)) { \ ForgetCurrentSubmission(); \ return rv; \ } nsresult HTMLFormElement::DoSubmit(WidgetEvent* aEvent) { NS_ASSERTION(GetComposedDoc(), "Should never get here without a current doc"); if (mIsSubmitting) { NS_WARNING("Preventing double form submission"); // XXX Should this return an error? return NS_OK; } // Mark us as submitting so that we don't try to submit again mIsSubmitting = true; NS_ASSERTION(!mWebProgress && !mSubmittingRequest, "Web progress / submitting request should not exist here!"); nsAutoPtr<HTMLFormSubmission> submission; // // prepare the submission object // nsresult rv = BuildSubmission(getter_Transfers(submission), aEvent); if (NS_FAILED(rv)) { mIsSubmitting = false; return rv; } // XXXbz if the script global is that for an sXBL/XBL2 doc, it won't // be a window... nsPIDOMWindowOuter *window = OwnerDoc()->GetWindow(); if (window) { mSubmitPopupState = window->GetPopupControlState(); } else { mSubmitPopupState = openAbused; } mSubmitInitiatedFromUserInput = EventStateManager::IsHandlingUserInput(); if(mDeferSubmission) { // we are in an event handler, JS submitted so we have to // defer this submission. let's remember it and return // without submitting mPendingSubmission = submission; // ensure reentrancy mIsSubmitting = false; return NS_OK; } // // perform the submission // return SubmitSubmission(submission); } nsresult HTMLFormElement::BuildSubmission(HTMLFormSubmission** aFormSubmission, WidgetEvent* aEvent) { NS_ASSERTION(!mPendingSubmission, "tried to build two submissions!"); // Get the originating frame (failure is non-fatal) nsGenericHTMLElement* originatingElement = nullptr; if (aEvent) { InternalFormEvent* formEvent = aEvent->AsFormEvent(); if (formEvent) { nsIContent* originator = formEvent->mOriginator; if (originator) { if (!originator->IsHTMLElement()) { return NS_ERROR_UNEXPECTED; } originatingElement = static_cast<nsGenericHTMLElement*>(originator); } } } nsresult rv; // // Get the submission object // rv = HTMLFormSubmission::GetFromForm(this, originatingElement, aFormSubmission); NS_ENSURE_SUBMIT_SUCCESS(rv); // // Dump the data into the submission object // rv = WalkFormElements(*aFormSubmission); NS_ENSURE_SUBMIT_SUCCESS(rv); return NS_OK; } nsresult HTMLFormElement::SubmitSubmission(HTMLFormSubmission* aFormSubmission) { nsresult rv; nsIContent* originatingElement = aFormSubmission->GetOriginatingElement(); // // Get the action and target // nsCOMPtr<nsIURI> actionURI; rv = GetActionURL(getter_AddRefs(actionURI), originatingElement); NS_ENSURE_SUBMIT_SUCCESS(rv); if (!actionURI) { mIsSubmitting = false; return NS_OK; } // If there is no link handler, then we won't actually be able to submit. nsIDocument* doc = GetComposedDoc(); nsCOMPtr<nsISupports> container = doc ? doc->GetContainer() : nullptr; nsCOMPtr<nsILinkHandler> linkHandler(do_QueryInterface(container)); if (!linkHandler || IsEditable()) { mIsSubmitting = false; return NS_OK; } // javascript URIs are not really submissions; they just call a function. // Also, they may synchronously call submit(), and we want them to be able to // do so while still disallowing other double submissions. (Bug 139798) // Note that any other URI types that are of equivalent type should also be // added here. // XXXbz this is a mess. The real issue here is that nsJSChannel sets the // LOAD_BACKGROUND flag, so doesn't notify us, compounded by the fact that // the JS executes before we forget the submission in OnStateChange on // STATE_STOP. As a result, we have to make sure that we simply pretend // we're not submitting when submitting to a JS URL. That's kinda bogus, but // there we are. bool schemeIsJavaScript = false; if (NS_SUCCEEDED(actionURI->SchemeIs("javascript", &schemeIsJavaScript)) && schemeIsJavaScript) { mIsSubmitting = false; } // The target is the originating element formtarget attribute if the element // is a submit control and has such an attribute. // Otherwise, the target is the form owner's target attribute, // if it has such an attribute. // Finally, if one of the child nodes of the head element is a base element // with a target attribute, then the value of the target attribute of the // first such base element; or, if there is no such element, the empty string. nsAutoString target; if (!(originatingElement && originatingElement->GetAttr(kNameSpaceID_None, nsGkAtoms::formtarget, target)) && !GetAttr(kNameSpaceID_None, nsGkAtoms::target, target)) { GetBaseTarget(target); } // // Notify observers of submit // bool cancelSubmit = false; if (mNotifiedObservers) { cancelSubmit = mNotifiedObserversResult; } else { rv = NotifySubmitObservers(actionURI, &cancelSubmit, true); NS_ENSURE_SUBMIT_SUCCESS(rv); } if (cancelSubmit) { mIsSubmitting = false; return NS_OK; } cancelSubmit = false; rv = NotifySubmitObservers(actionURI, &cancelSubmit, false); NS_ENSURE_SUBMIT_SUCCESS(rv); if (cancelSubmit) { mIsSubmitting = false; return NS_OK; } // // Submit // nsCOMPtr<nsIDocShell> docShell; { nsAutoPopupStatePusher popupStatePusher(mSubmitPopupState); AutoHandlingUserInputStatePusher userInpStatePusher( mSubmitInitiatedFromUserInput, nullptr, doc); nsCOMPtr<nsIInputStream> postDataStream; rv = aFormSubmission->GetEncodedSubmission(actionURI, getter_AddRefs(postDataStream)); NS_ENSURE_SUBMIT_SUCCESS(rv); rv = linkHandler->OnLinkClickSync(this, actionURI, target.get(), NullString(), postDataStream, nullptr, getter_AddRefs(docShell), getter_AddRefs(mSubmittingRequest)); NS_ENSURE_SUBMIT_SUCCESS(rv); } // Even if the submit succeeds, it's possible for there to be no docshell // or request; for example, if it's to a named anchor within the same page // the submit will not really do anything. if (docShell) { // If the channel is pending, we have to listen for web progress. bool pending = false; mSubmittingRequest->IsPending(&pending); if (pending && !schemeIsJavaScript) { nsCOMPtr<nsIWebProgress> webProgress = do_GetInterface(docShell); NS_ASSERTION(webProgress, "nsIDocShell not converted to nsIWebProgress!"); rv = webProgress->AddProgressListener(this, nsIWebProgress::NOTIFY_STATE_ALL); NS_ENSURE_SUBMIT_SUCCESS(rv); mWebProgress = do_GetWeakReference(webProgress); NS_ASSERTION(mWebProgress, "can't hold weak ref to webprogress!"); } else { ForgetCurrentSubmission(); } } else { ForgetCurrentSubmission(); } return rv; } nsresult HTMLFormElement::DoSecureToInsecureSubmitCheck(nsIURI* aActionURL, bool* aCancelSubmit) { *aCancelSubmit = false; // Only ask the user about posting from a secure URI to an insecure URI if // this element is in the root document. When this is not the case, the mixed // content blocker will take care of security for us. nsIDocument* parent = OwnerDoc()->GetParentDocument(); bool isRootDocument = (!parent || nsContentUtils::IsChromeDoc(parent)); if (!isRootDocument) { return NS_OK; } nsIPrincipal* principal = NodePrincipal(); if (!principal) { *aCancelSubmit = true; return NS_OK; } nsCOMPtr<nsIURI> principalURI; nsresult rv = principal->GetURI(getter_AddRefs(principalURI)); if (NS_FAILED(rv)) { return rv; } if (!principalURI) { principalURI = OwnerDoc()->GetDocumentURI(); } bool formIsHTTPS; rv = principalURI->SchemeIs("https", &formIsHTTPS); if (NS_FAILED(rv)) { return rv; } bool actionIsHTTPS; rv = aActionURL->SchemeIs("https", &actionIsHTTPS); if (NS_FAILED(rv)) { return rv; } bool actionIsJS; rv = aActionURL->SchemeIs("javascript", &actionIsJS); if (NS_FAILED(rv)) { return rv; } if (!formIsHTTPS || actionIsHTTPS || actionIsJS) { return NS_OK; } nsCOMPtr<nsPIDOMWindowOuter> window = OwnerDoc()->GetWindow(); if (!window) { return NS_ERROR_FAILURE; } nsCOMPtr<nsIDocShell> docShell = window->GetDocShell(); if (!docShell) { return NS_ERROR_FAILURE; } nsCOMPtr<nsIPrompt> prompt = do_GetInterface(docShell); if (!prompt) { return NS_ERROR_FAILURE; } nsCOMPtr<nsIStringBundle> stringBundle; nsCOMPtr<nsIStringBundleService> stringBundleService = mozilla::services::GetStringBundleService(); if (!stringBundleService) { return NS_ERROR_FAILURE; } rv = stringBundleService->CreateBundle( "chrome://global/locale/browser.properties", getter_AddRefs(stringBundle)); if (NS_FAILED(rv)) { return rv; } nsAutoString title; nsAutoString message; nsAutoString cont; stringBundle->GetStringFromName( u"formPostSecureToInsecureWarning.title", getter_Copies(title)); stringBundle->GetStringFromName( u"formPostSecureToInsecureWarning.message", getter_Copies(message)); stringBundle->GetStringFromName( u"formPostSecureToInsecureWarning.continue", getter_Copies(cont)); int32_t buttonPressed; bool checkState = false; // this is unused (ConfirmEx requires this parameter) rv = prompt->ConfirmEx(title.get(), message.get(), (nsIPrompt::BUTTON_TITLE_IS_STRING * nsIPrompt::BUTTON_POS_0) + (nsIPrompt::BUTTON_TITLE_CANCEL * nsIPrompt::BUTTON_POS_1), cont.get(), nullptr, nullptr, nullptr, &checkState, &buttonPressed); if (NS_FAILED(rv)) { return rv; } *aCancelSubmit = (buttonPressed == 1); uint32_t telemetryBucket = nsISecurityUITelemetry::WARNING_CONFIRM_POST_TO_INSECURE_FROM_SECURE; mozilla::Telemetry::Accumulate(mozilla::Telemetry::SECURITY_UI, telemetryBucket); if (!*aCancelSubmit) { // The user opted to continue, so note that in the next telemetry bucket. mozilla::Telemetry::Accumulate(mozilla::Telemetry::SECURITY_UI, telemetryBucket + 1); } return NS_OK; } nsresult HTMLFormElement::NotifySubmitObservers(nsIURI* aActionURL, bool* aCancelSubmit, bool aEarlyNotify) { // If this is the first form, bring alive the first form submit // category observers if (!gFirstFormSubmitted) { gFirstFormSubmitted = true; NS_CreateServicesFromCategory(NS_FIRST_FORMSUBMIT_CATEGORY, nullptr, NS_FIRST_FORMSUBMIT_CATEGORY); } if (!aEarlyNotify) { nsresult rv = DoSecureToInsecureSubmitCheck(aActionURL, aCancelSubmit); if (NS_FAILED(rv)) { return rv; } if (*aCancelSubmit) { return NS_OK; } } // Notify observers that the form is being submitted. nsCOMPtr<nsIObserverService> service = mozilla::services::GetObserverService(); if (!service) return NS_ERROR_FAILURE; nsCOMPtr<nsISimpleEnumerator> theEnum; nsresult rv = service->EnumerateObservers(aEarlyNotify ? NS_EARLYFORMSUBMIT_SUBJECT : NS_FORMSUBMIT_SUBJECT, getter_AddRefs(theEnum)); NS_ENSURE_SUCCESS(rv, rv); if (theEnum) { nsCOMPtr<nsISupports> inst; *aCancelSubmit = false; // XXXbz what do the submit observers actually want? The window // of the document this is shown in? Or something else? // sXBL/XBL2 issue nsCOMPtr<nsPIDOMWindowOuter> window = OwnerDoc()->GetWindow(); bool loop = true; while (NS_SUCCEEDED(theEnum->HasMoreElements(&loop)) && loop) { theEnum->GetNext(getter_AddRefs(inst)); nsCOMPtr<nsIFormSubmitObserver> formSubmitObserver( do_QueryInterface(inst)); if (formSubmitObserver) { rv = formSubmitObserver->Notify(this, window ? window->GetCurrentInnerWindow() : nullptr, aActionURL, aCancelSubmit); NS_ENSURE_SUCCESS(rv, rv); } if (*aCancelSubmit) { return NS_OK; } } } return rv; } nsresult HTMLFormElement::WalkFormElements(HTMLFormSubmission* aFormSubmission) { nsTArray<nsGenericHTMLFormElement*> sortedControls; nsresult rv = mControls->GetSortedControls(sortedControls); NS_ENSURE_SUCCESS(rv, rv); uint32_t len = sortedControls.Length(); // Hold a reference to the elements so they can't be deleted while // calling SubmitNamesValues(). for (uint32_t i = 0; i < len; ++i) { static_cast<nsGenericHTMLElement*>(sortedControls[i])->AddRef(); } // // Walk the list of nodes and call SubmitNamesValues() on the controls // for (uint32_t i = 0; i < len; ++i) { // Tell the control to submit its name/value pairs to the submission sortedControls[i]->SubmitNamesValues(aFormSubmission); } // Release the references. for (uint32_t i = 0; i < len; ++i) { static_cast<nsGenericHTMLElement*>(sortedControls[i])->Release(); } return NS_OK; } // nsIForm NS_IMETHODIMP_(uint32_t) HTMLFormElement::GetElementCount() const { uint32_t count = 0; mControls->GetLength(&count); return count; } Element* HTMLFormElement::IndexedGetter(uint32_t aIndex, bool &aFound) { Element* element = mControls->mElements.SafeElementAt(aIndex, nullptr); aFound = element != nullptr; return element; } NS_IMETHODIMP_(nsIFormControl*) HTMLFormElement::GetElementAt(int32_t aIndex) const { return mControls->mElements.SafeElementAt(aIndex, nullptr); } /** * Compares the position of aControl1 and aControl2 in the document * @param aControl1 First control to compare. * @param aControl2 Second control to compare. * @param aForm Parent form of the controls. * @return < 0 if aControl1 is before aControl2, * > 0 if aControl1 is after aControl2, * 0 otherwise */ /* static */ int32_t HTMLFormElement::CompareFormControlPosition(Element* aElement1, Element* aElement2, const nsIContent* aForm) { NS_ASSERTION(aElement1 != aElement2, "Comparing a form control to itself"); // If an element has a @form, we can assume it *might* be able to not have // a parent and still be in the form. NS_ASSERTION((aElement1->HasAttr(kNameSpaceID_None, nsGkAtoms::form) || aElement1->GetParent()) && (aElement2->HasAttr(kNameSpaceID_None, nsGkAtoms::form) || aElement2->GetParent()), "Form controls should always have parents"); // If we pass aForm, we are assuming both controls are form descendants which // is not always the case. This function should work but maybe slower. // However, checking if both elements are form descendants may be slow too... // TODO: remove the prevent asserts fix, see bug 598468. #ifdef DEBUG nsLayoutUtils::gPreventAssertInCompareTreePosition = true; int32_t rVal = nsLayoutUtils::CompareTreePosition(aElement1, aElement2, aForm); nsLayoutUtils::gPreventAssertInCompareTreePosition = false; return rVal; #else // DEBUG return nsLayoutUtils::CompareTreePosition(aElement1, aElement2, aForm); #endif // DEBUG } #ifdef DEBUG /** * Checks that all form elements are in document order. Asserts if any pair of * consecutive elements are not in increasing document order. * * @param aControls List of form controls to check. * @param aForm Parent form of the controls. */ /* static */ void HTMLFormElement::AssertDocumentOrder( const nsTArray<nsGenericHTMLFormElement*>& aControls, nsIContent* aForm) { // TODO: remove the return statement with bug 598468. // This is done to prevent asserts in some edge cases. return; // Only iterate if aControls is not empty, since otherwise // |aControls.Length() - 1| will be a very large unsigned number... not what // we want here. if (!aControls.IsEmpty()) { for (uint32_t i = 0; i < aControls.Length() - 1; ++i) { NS_ASSERTION(CompareFormControlPosition(aControls[i], aControls[i + 1], aForm) < 0, "Form controls not ordered correctly"); } } } #endif void HTMLFormElement::PostPasswordEvent() { // Don't fire another add event if we have a pending add event. if (mFormPasswordEventDispatcher.get()) { return; } mFormPasswordEventDispatcher = new AsyncEventDispatcher(this, NS_LITERAL_STRING("DOMFormHasPassword"), true, true); mFormPasswordEventDispatcher->PostDOMEvent(); } namespace { struct FormComparator { Element* const mChild; HTMLFormElement* const mForm; FormComparator(Element* aChild, HTMLFormElement* aForm) : mChild(aChild), mForm(aForm) {} int operator()(Element* aElement) const { return HTMLFormElement::CompareFormControlPosition(mChild, aElement, mForm); } }; } // namespace // This function return true if the element, once appended, is the last one in // the array. template<typename ElementType> static bool AddElementToList(nsTArray<ElementType*>& aList, ElementType* aChild, HTMLFormElement* aForm) { NS_ASSERTION(aList.IndexOf(aChild) == aList.NoIndex, "aChild already in aList"); const uint32_t count = aList.Length(); ElementType* element; bool lastElement = false; // Optimize most common case where we insert at the end. int32_t position = -1; if (count > 0) { element = aList[count - 1]; position = HTMLFormElement::CompareFormControlPosition(aChild, element, aForm); } // If this item comes after the last element, or the elements array is // empty, we append to the end. Otherwise, we do a binary search to // determine where the element should go. if (position >= 0 || count == 0) { // WEAK - don't addref aList.AppendElement(aChild); lastElement = true; } else { size_t idx; BinarySearchIf(aList, 0, count, FormComparator(aChild, aForm), &idx); // WEAK - don't addref aList.InsertElementAt(idx, aChild); } return lastElement; } nsresult HTMLFormElement::AddElement(nsGenericHTMLFormElement* aChild, bool aUpdateValidity, bool aNotify) { // If an element has a @form, we can assume it *might* be able to not have // a parent and still be in the form. NS_ASSERTION(aChild->HasAttr(kNameSpaceID_None, nsGkAtoms::form) || aChild->GetParent(), "Form control should have a parent"); // Determine whether to add the new element to the elements or // the not-in-elements list. bool childInElements = HTMLFormControlsCollection::ShouldBeInElements(aChild); nsTArray<nsGenericHTMLFormElement*>& controlList = childInElements ? mControls->mElements : mControls->mNotInElements; bool lastElement = AddElementToList(controlList, aChild, this); #ifdef DEBUG AssertDocumentOrder(controlList, this); #endif int32_t type = aChild->GetType(); // // If it is a password control, and the password manager has not yet been // initialized, initialize the password manager // if (type == NS_FORM_INPUT_PASSWORD) { if (!gPasswordManagerInitialized) { gPasswordManagerInitialized = true; NS_CreateServicesFromCategory(NS_PASSWORDMANAGER_CATEGORY, nullptr, NS_PASSWORDMANAGER_CATEGORY); } PostPasswordEvent(); } // Default submit element handling if (aChild->IsSubmitControl()) { // Update mDefaultSubmitElement, mFirstSubmitInElements, // mFirstSubmitNotInElements. nsGenericHTMLFormElement** firstSubmitSlot = childInElements ? &mFirstSubmitInElements : &mFirstSubmitNotInElements; // The new child is the new first submit in its list if the firstSubmitSlot // is currently empty or if the child is before what's currently in the // slot. Note that if we already have a control in firstSubmitSlot and // we're appending this element can't possibly replace what's currently in // the slot. Also note that aChild can't become the mDefaultSubmitElement // unless it replaces what's in the slot. If it _does_ replace what's in // the slot, it becomes the default submit if either the default submit is // what's in the slot or the child is earlier than the default submit. nsGenericHTMLFormElement* oldDefaultSubmit = mDefaultSubmitElement; if (!*firstSubmitSlot || (!lastElement && CompareFormControlPosition(aChild, *firstSubmitSlot, this) < 0)) { // Update mDefaultSubmitElement if it's currently in a valid state. // Valid state means either non-null or null because there are in fact // no submit elements around. if ((mDefaultSubmitElement || (!mFirstSubmitInElements && !mFirstSubmitNotInElements)) && (*firstSubmitSlot == mDefaultSubmitElement || CompareFormControlPosition(aChild, mDefaultSubmitElement, this) < 0)) { mDefaultSubmitElement = aChild; } *firstSubmitSlot = aChild; } NS_POSTCONDITION(mDefaultSubmitElement == mFirstSubmitInElements || mDefaultSubmitElement == mFirstSubmitNotInElements || !mDefaultSubmitElement, "What happened here?"); // Notify that the state of the previous default submit element has changed // if the element which is the default submit element has changed. The new // default submit element is responsible for its own state update. if (oldDefaultSubmit && oldDefaultSubmit != mDefaultSubmitElement) { oldDefaultSubmit->UpdateState(aNotify); } } // If the element is subject to constraint validaton and is invalid, we need // to update our internal counter. if (aUpdateValidity) { nsCOMPtr<nsIConstraintValidation> cvElmt = do_QueryObject(aChild); if (cvElmt && cvElmt->IsCandidateForConstraintValidation() && !cvElmt->IsValid()) { UpdateValidity(false); } } // Notify the radio button it's been added to a group // This has to be done _after_ UpdateValidity() call to prevent the element // being count twice. if (type == NS_FORM_INPUT_RADIO) { RefPtr<HTMLInputElement> radio = static_cast<HTMLInputElement*>(aChild); radio->AddedToRadioGroup(); } return NS_OK; } nsresult HTMLFormElement::AddElementToTable(nsGenericHTMLFormElement* aChild, const nsAString& aName) { return mControls->AddElementToTable(aChild, aName); } nsresult HTMLFormElement::RemoveElement(nsGenericHTMLFormElement* aChild, bool aUpdateValidity) { // // Remove it from the radio group if it's a radio button // nsresult rv = NS_OK; if (aChild->GetType() == NS_FORM_INPUT_RADIO) { RefPtr<HTMLInputElement> radio = static_cast<HTMLInputElement*>(aChild); radio->WillRemoveFromRadioGroup(); } // Determine whether to remove the child from the elements list // or the not in elements list. bool childInElements = HTMLFormControlsCollection::ShouldBeInElements(aChild); nsTArray<nsGenericHTMLFormElement*>& controls = childInElements ? mControls->mElements : mControls->mNotInElements; // Find the index of the child. This will be used later if necessary // to find the default submit. size_t index = controls.IndexOf(aChild); NS_ENSURE_STATE(index != controls.NoIndex); controls.RemoveElementAt(index); // Update our mFirstSubmit* values. nsGenericHTMLFormElement** firstSubmitSlot = childInElements ? &mFirstSubmitInElements : &mFirstSubmitNotInElements; if (aChild == *firstSubmitSlot) { *firstSubmitSlot = nullptr; // We are removing the first submit in this list, find the new first submit uint32_t length = controls.Length(); for (uint32_t i = index; i < length; ++i) { nsGenericHTMLFormElement* currentControl = controls[i]; if (currentControl->IsSubmitControl()) { *firstSubmitSlot = currentControl; break; } } } if (aChild == mDefaultSubmitElement) { // Need to reset mDefaultSubmitElement. Do this asynchronously so // that we're not doing it while the DOM is in flux. mDefaultSubmitElement = nullptr; nsContentUtils::AddScriptRunner(new RemoveElementRunnable(this)); // Note that we don't need to notify on the old default submit (which is // being removed) because it's either being removed from the DOM or // changing attributes in a way that makes it responsible for sending its // own notifications. } // If the element was subject to constraint validaton and is invalid, we need // to update our internal counter. if (aUpdateValidity) { nsCOMPtr<nsIConstraintValidation> cvElmt = do_QueryObject(aChild); if (cvElmt && cvElmt->IsCandidateForConstraintValidation() && !cvElmt->IsValid()) { UpdateValidity(true); } } return rv; } void HTMLFormElement::HandleDefaultSubmitRemoval() { if (mDefaultSubmitElement) { // Already got reset somehow; nothing else to do here return; } if (!mFirstSubmitNotInElements) { mDefaultSubmitElement = mFirstSubmitInElements; } else if (!mFirstSubmitInElements) { mDefaultSubmitElement = mFirstSubmitNotInElements; } else { NS_ASSERTION(mFirstSubmitInElements != mFirstSubmitNotInElements, "How did that happen?"); // Have both; use the earlier one mDefaultSubmitElement = CompareFormControlPosition(mFirstSubmitInElements, mFirstSubmitNotInElements, this) < 0 ? mFirstSubmitInElements : mFirstSubmitNotInElements; } NS_POSTCONDITION(mDefaultSubmitElement == mFirstSubmitInElements || mDefaultSubmitElement == mFirstSubmitNotInElements, "What happened here?"); // Notify about change if needed. if (mDefaultSubmitElement) { mDefaultSubmitElement->UpdateState(true); } } nsresult HTMLFormElement::RemoveElementFromTableInternal( nsInterfaceHashtable<nsStringHashKey,nsISupports>& aTable, nsIContent* aChild, const nsAString& aName) { nsCOMPtr<nsISupports> supports; if (!aTable.Get(aName, getter_AddRefs(supports))) return NS_OK; // Single element in the hash, just remove it if it's the one // we're trying to remove... if (supports == aChild) { aTable.Remove(aName); ++mExpandoAndGeneration.generation; return NS_OK; } nsCOMPtr<nsIContent> content(do_QueryInterface(supports)); if (content) { return NS_OK; } nsCOMPtr<nsIDOMNodeList> nodeList(do_QueryInterface(supports)); NS_ENSURE_TRUE(nodeList, NS_ERROR_FAILURE); // Upcast, uggly, but it works! nsBaseContentList *list = static_cast<nsBaseContentList*>(nodeList.get()); list->RemoveElement(aChild); uint32_t length = 0; list->GetLength(&length); if (!length) { // If the list is empty we remove if from our hash, this shouldn't // happen tho aTable.Remove(aName); ++mExpandoAndGeneration.generation; } else if (length == 1) { // Only one element left, replace the list in the hash with the // single element. nsIContent* node = list->Item(0); if (node) { aTable.Put(aName, node); } } return NS_OK; } nsresult HTMLFormElement::RemoveElementFromTable(nsGenericHTMLFormElement* aElement, const nsAString& aName, RemoveElementReason aRemoveReason) { // If the element is being removed from the form, we have to remove it from // the past names map. if (aRemoveReason == ElementRemoved) { uint32_t oldCount = mPastNameLookupTable.Count(); for (auto iter = mPastNameLookupTable.Iter(); !iter.Done(); iter.Next()) { if (static_cast<void*>(aElement) == iter.Data()) { iter.Remove(); } } if (oldCount != mPastNameLookupTable.Count()) { ++mExpandoAndGeneration.generation; } } return mControls->RemoveElementFromTable(aElement, aName); } already_AddRefed<nsISupports> HTMLFormElement::NamedGetter(const nsAString& aName, bool &aFound) { aFound = true; nsCOMPtr<nsISupports> result = DoResolveName(aName, true); if (result) { AddToPastNamesMap(aName, result); return result.forget(); } result = mImageNameLookupTable.GetWeak(aName); if (result) { AddToPastNamesMap(aName, result); return result.forget(); } result = mPastNameLookupTable.GetWeak(aName); if (result) { return result.forget(); } aFound = false; return nullptr; } void HTMLFormElement::GetSupportedNames(nsTArray<nsString >& aRetval) { // TODO https://github.com/whatwg/html/issues/1731 } already_AddRefed<nsISupports> HTMLFormElement::FindNamedItem(const nsAString& aName, nsWrapperCache** aCache) { // FIXME Get the wrapper cache from DoResolveName. bool found; nsCOMPtr<nsISupports> result = NamedGetter(aName, found); if (result) { *aCache = nullptr; return result.forget(); } return nullptr; } already_AddRefed<nsISupports> HTMLFormElement::DoResolveName(const nsAString& aName, bool aFlushContent) { nsCOMPtr<nsISupports> result = mControls->NamedItemInternal(aName, aFlushContent); return result.forget(); } void HTMLFormElement::OnSubmitClickBegin(nsIContent* aOriginatingElement) { mDeferSubmission = true; // Prepare to run NotifySubmitObservers early before the // scripts on the page get to modify the form data, possibly // throwing off any password manager. (bug 257781) nsCOMPtr<nsIURI> actionURI; nsresult rv; rv = GetActionURL(getter_AddRefs(actionURI), aOriginatingElement); if (NS_FAILED(rv) || !actionURI) return; // Notify observers of submit if the form is valid. // TODO: checking for mInvalidElementsCount is a temporary fix that should be // removed with bug 610402. if (mInvalidElementsCount == 0) { bool cancelSubmit = false; rv = NotifySubmitObservers(actionURI, &cancelSubmit, true); if (NS_SUCCEEDED(rv)) { mNotifiedObservers = true; mNotifiedObserversResult = cancelSubmit; } } } void HTMLFormElement::OnSubmitClickEnd() { mDeferSubmission = false; } void HTMLFormElement::FlushPendingSubmission() { if (mPendingSubmission) { // Transfer owning reference so that the submissioin doesn't get deleted // if we reenter nsAutoPtr<HTMLFormSubmission> submission = Move(mPendingSubmission); SubmitSubmission(submission); } } nsresult HTMLFormElement::GetActionURL(nsIURI** aActionURL, nsIContent* aOriginatingElement) { nsresult rv = NS_OK; *aActionURL = nullptr; // // Grab the URL string // // If the originating element is a submit control and has the formaction // attribute specified, it should be used. Otherwise, the action attribute // from the form element should be used. // nsAutoString action; if (aOriginatingElement && aOriginatingElement->HasAttr(kNameSpaceID_None, nsGkAtoms::formaction)) { #ifdef DEBUG nsCOMPtr<nsIFormControl> formControl = do_QueryInterface(aOriginatingElement); NS_ASSERTION(formControl && formControl->IsSubmitControl(), "The originating element must be a submit form control!"); #endif // DEBUG nsCOMPtr<nsIDOMHTMLInputElement> inputElement = do_QueryInterface(aOriginatingElement); if (inputElement) { inputElement->GetFormAction(action); } else { nsCOMPtr<nsIDOMHTMLButtonElement> buttonElement = do_QueryInterface(aOriginatingElement); if (buttonElement) { buttonElement->GetFormAction(action); } else { NS_ERROR("Originating element must be an input or button element!"); return NS_ERROR_UNEXPECTED; } } } else { GetAction(action); } // // Form the full action URL // // Get the document to form the URL. // We'll also need it later to get the DOM window when notifying form submit // observers (bug 33203) if (!IsInUncomposedDoc()) { return NS_OK; // No doc means don't submit, see Bug 28988 } // Get base URL nsIDocument *document = OwnerDoc(); nsIURI *docURI = document->GetDocumentURI(); NS_ENSURE_TRUE(docURI, NS_ERROR_UNEXPECTED); // If an action is not specified and we are inside // a HTML document then reload the URL. This makes us // compatible with 4.x browsers. // If we are in some other type of document such as XML or // XUL, do nothing. This prevents undesirable reloading of // a document inside XUL. nsCOMPtr<nsIURI> actionURL; if (action.IsEmpty()) { nsCOMPtr<nsIHTMLDocument> htmlDoc(do_QueryInterface(document)); if (!htmlDoc) { // Must be a XML, XUL or other non-HTML document type // so do nothing. return NS_OK; } rv = docURI->Clone(getter_AddRefs(actionURL)); NS_ENSURE_SUCCESS(rv, rv); } else { nsCOMPtr<nsIURI> baseURL = GetBaseURI(); NS_ASSERTION(baseURL, "No Base URL found in Form Submit!\n"); if (!baseURL) { return NS_OK; // No base URL -> exit early, see Bug 30721 } rv = NS_NewURI(getter_AddRefs(actionURL), action, nullptr, baseURL); NS_ENSURE_SUCCESS(rv, rv); } // // Verify the URL should be reached // // Get security manager, check to see if access to action URI is allowed. // nsIScriptSecurityManager *securityManager = nsContentUtils::GetSecurityManager(); rv = securityManager-> CheckLoadURIWithPrincipal(NodePrincipal(), actionURL, nsIScriptSecurityManager::STANDARD); NS_ENSURE_SUCCESS(rv, rv); // Check if CSP allows this form-action nsCOMPtr<nsIContentSecurityPolicy> csp; rv = NodePrincipal()->GetCsp(getter_AddRefs(csp)); NS_ENSURE_SUCCESS(rv, rv); if (csp) { bool permitsFormAction = true; // form-action is only enforced if explicitly defined in the // policy - do *not* consult default-src, see: // http://www.w3.org/TR/CSP2/#directive-default-src rv = csp->Permits(actionURL, nsIContentSecurityPolicy::FORM_ACTION_DIRECTIVE, true, &permitsFormAction); NS_ENSURE_SUCCESS(rv, rv); if (!permitsFormAction) { return NS_ERROR_CSP_FORM_ACTION_VIOLATION; } } // Potentially the page uses the CSP directive 'upgrade-insecure-requests'. In // such a case we have to upgrade the action url from http:// to https://. // If the actionURL is not http, then there is nothing to do. bool isHttpScheme = false; rv = actionURL->SchemeIs("http", &isHttpScheme); NS_ENSURE_SUCCESS(rv, rv); if (isHttpScheme && document->GetUpgradeInsecureRequests(false)) { // let's use the old specification before the upgrade for logging nsAutoCString spec; rv = actionURL->GetSpec(spec); NS_ENSURE_SUCCESS(rv, rv); NS_ConvertUTF8toUTF16 reportSpec(spec); // upgrade the actionURL from http:// to use https:// nsCOMPtr<nsIURI> upgradedActionURL; rv = NS_GetSecureUpgradedURI(actionURL, getter_AddRefs(upgradedActionURL)); NS_ENSURE_SUCCESS(rv, rv); actionURL = upgradedActionURL.forget(); // let's log a message to the console that we are upgrading a request nsAutoCString scheme; rv = actionURL->GetScheme(scheme); NS_ENSURE_SUCCESS(rv, rv); NS_ConvertUTF8toUTF16 reportScheme(scheme); const char16_t* params[] = { reportSpec.get(), reportScheme.get() }; CSP_LogLocalizedStr(u"upgradeInsecureRequest", params, ArrayLength(params), EmptyString(), // aSourceFile EmptyString(), // aScriptSample 0, // aLineNumber 0, // aColumnNumber nsIScriptError::warningFlag, "CSP", document->InnerWindowID()); } // // Assign to the output // actionURL.forget(aActionURL); return rv; } NS_IMETHODIMP_(nsIFormControl*) HTMLFormElement::GetDefaultSubmitElement() const { NS_PRECONDITION(mDefaultSubmitElement == mFirstSubmitInElements || mDefaultSubmitElement == mFirstSubmitNotInElements, "What happened here?"); return mDefaultSubmitElement; } bool HTMLFormElement::IsDefaultSubmitElement(const nsIFormControl* aControl) const { NS_PRECONDITION(aControl, "Unexpected call"); if (aControl == mDefaultSubmitElement) { // Yes, it is return true; } if (mDefaultSubmitElement || (aControl != mFirstSubmitInElements && aControl != mFirstSubmitNotInElements)) { // It isn't return false; } // mDefaultSubmitElement is null, but we have a non-null submit around // (aControl, in fact). figure out whether it's in fact the default submit // and just hasn't been set that way yet. Note that we can't just call // HandleDefaultSubmitRemoval because we might need to notify to handle that // correctly and we don't know whether that's safe right here. if (!mFirstSubmitInElements || !mFirstSubmitNotInElements) { // We only have one first submit; aControl has to be it return true; } // We have both kinds of submits. Check which comes first. nsIFormControl* defaultSubmit = CompareFormControlPosition(mFirstSubmitInElements, mFirstSubmitNotInElements, this) < 0 ? mFirstSubmitInElements : mFirstSubmitNotInElements; return aControl == defaultSubmit; } bool HTMLFormElement::ImplicitSubmissionIsDisabled() const { // Input text controls are always in the elements list. uint32_t numDisablingControlsFound = 0; uint32_t length = mControls->mElements.Length(); for (uint32_t i = 0; i < length && numDisablingControlsFound < 2; ++i) { if (mControls->mElements[i]->IsSingleLineTextControl(false) || mControls->mElements[i]->GetType() == NS_FORM_INPUT_NUMBER) { numDisablingControlsFound++; } } return numDisablingControlsFound != 1; } NS_IMETHODIMP HTMLFormElement::GetEncoding(nsAString& aEncoding) { return GetEnctype(aEncoding); } NS_IMETHODIMP HTMLFormElement::SetEncoding(const nsAString& aEncoding) { return SetEnctype(aEncoding); } int32_t HTMLFormElement::Length() { return mControls->Length(); } NS_IMETHODIMP HTMLFormElement::GetLength(int32_t* aLength) { *aLength = Length(); return NS_OK; } void HTMLFormElement::ForgetCurrentSubmission() { mNotifiedObservers = false; mIsSubmitting = false; mSubmittingRequest = nullptr; nsCOMPtr<nsIWebProgress> webProgress = do_QueryReferent(mWebProgress); if (webProgress) { webProgress->RemoveProgressListener(this); } mWebProgress = nullptr; } bool HTMLFormElement::CheckFormValidity(nsIMutableArray* aInvalidElements) const { bool ret = true; nsTArray<nsGenericHTMLFormElement*> sortedControls; if (NS_FAILED(mControls->GetSortedControls(sortedControls))) { return false; } uint32_t len = sortedControls.Length(); // Hold a reference to the elements so they can't be deleted while calling // the invalid events. for (uint32_t i = 0; i < len; ++i) { sortedControls[i]->AddRef(); } for (uint32_t i = 0; i < len; ++i) { nsCOMPtr<nsIConstraintValidation> cvElmt = do_QueryObject(sortedControls[i]); if (cvElmt && cvElmt->IsCandidateForConstraintValidation() && !cvElmt->IsValid()) { ret = false; bool defaultAction = true; nsContentUtils::DispatchTrustedEvent(sortedControls[i]->OwnerDoc(), static_cast<nsIContent*>(sortedControls[i]), NS_LITERAL_STRING("invalid"), false, true, &defaultAction); // Add all unhandled invalid controls to aInvalidElements if the caller // requested them. if (defaultAction && aInvalidElements) { aInvalidElements->AppendElement(ToSupports(sortedControls[i]), false); } } } // Release the references. for (uint32_t i = 0; i < len; ++i) { static_cast<nsGenericHTMLElement*>(sortedControls[i])->Release(); } return ret; } bool HTMLFormElement::CheckValidFormSubmission() { /** * Check for form validity: do not submit a form if there are unhandled * invalid controls in the form. * This should not be done if the form has been submitted with .submit(). * * NOTE: for the moment, we are also checking that there is an observer for * NS_INVALIDFORMSUBMIT_SUBJECT so it will prevent blocking form submission * if the browser does not have implemented a UI yet. * * TODO: the check for observer should be removed later when HTML5 Forms will * be spread enough and authors will assume forms can't be submitted when * invalid. See bug 587671. */ NS_ASSERTION(!HasAttr(kNameSpaceID_None, nsGkAtoms::novalidate), "We shouldn't be there if novalidate is set!"); // When .submit() is called aEvent = nullptr so we can rely on that to know if // we have to check the validity of the form. nsCOMPtr<nsIObserverService> service = mozilla::services::GetObserverService(); if (!service) { NS_WARNING("No observer service available!"); return true; } nsCOMPtr<nsISimpleEnumerator> theEnum; nsresult rv = service->EnumerateObservers(NS_INVALIDFORMSUBMIT_SUBJECT, getter_AddRefs(theEnum)); // Return true on error here because that's what we always did NS_ENSURE_SUCCESS(rv, true); bool hasObserver = false; rv = theEnum->HasMoreElements(&hasObserver); // Do not check form validity if there is no observer for // NS_INVALIDFORMSUBMIT_SUBJECT. if (NS_SUCCEEDED(rv) && hasObserver) { nsCOMPtr<nsIMutableArray> invalidElements = do_CreateInstance(NS_ARRAY_CONTRACTID, &rv); // Return true on error here because that's what we always did NS_ENSURE_SUCCESS(rv, true); if (!CheckFormValidity(invalidElements.get())) { // For the first invalid submission, we should update element states. // We have to do that _before_ calling the observers so we are sure they // will not interfere (like focusing the element). if (!mEverTriedInvalidSubmit) { mEverTriedInvalidSubmit = true; /* * We are going to call update states assuming elements want to * be notified because we can't know. * Submissions shouldn't happen during parsing so it _should_ be safe. */ nsAutoScriptBlocker scriptBlocker; for (uint32_t i = 0, length = mControls->mElements.Length(); i < length; ++i) { // Input elements can trigger a form submission and we want to // update the style in that case. if (mControls->mElements[i]->IsHTMLElement(nsGkAtoms::input) && nsContentUtils::IsFocusedContent(mControls->mElements[i])) { static_cast<HTMLInputElement*>(mControls->mElements[i]) ->UpdateValidityUIBits(true); } mControls->mElements[i]->UpdateState(true); } // Because of backward compatibility, <input type='image'> is not in // elements but can be invalid. // TODO: should probably be removed when bug 606491 will be fixed. for (uint32_t i = 0, length = mControls->mNotInElements.Length(); i < length; ++i) { mControls->mNotInElements[i]->UpdateState(true); } } nsCOMPtr<nsISupports> inst; nsCOMPtr<nsIFormSubmitObserver> observer; bool more = true; while (NS_SUCCEEDED(theEnum->HasMoreElements(&more)) && more) { theEnum->GetNext(getter_AddRefs(inst)); observer = do_QueryInterface(inst); if (observer) { observer->NotifyInvalidSubmit(this, static_cast<nsIArray*>(invalidElements)); } } // The form is invalid. Observers have been alerted. Do not submit. return false; } } else { NS_WARNING("There is no observer for \"invalidformsubmit\". \ One should be implemented!"); } return true; } bool HTMLFormElement::SubmissionCanProceed(Element* aSubmitter) { #ifdef DEBUG if (aSubmitter) { nsCOMPtr<nsIFormControl> fc = do_QueryInterface(aSubmitter); MOZ_ASSERT(fc); uint32_t type = fc->GetType(); MOZ_ASSERT(type == NS_FORM_INPUT_SUBMIT || type == NS_FORM_INPUT_IMAGE || type == NS_FORM_BUTTON_SUBMIT, "aSubmitter is not a submit control?"); } #endif // Modified step 2 of // https://html.spec.whatwg.org/multipage/forms.html#concept-form-submit -- // we're not checking whether the node document is disconnected yet... if (OwnerDoc()->GetSandboxFlags() & SANDBOXED_FORMS) { return false; } if (HasAttr(kNameSpaceID_None, nsGkAtoms::novalidate)) { return true; } if (aSubmitter && aSubmitter->HasAttr(kNameSpaceID_None, nsGkAtoms::formnovalidate)) { return true; } return CheckValidFormSubmission(); } void HTMLFormElement::UpdateValidity(bool aElementValidity) { if (aElementValidity) { --mInvalidElementsCount; } else { ++mInvalidElementsCount; } NS_ASSERTION(mInvalidElementsCount >= 0, "Something went seriously wrong!"); // The form validity has just changed if: // - there are no more invalid elements ; // - or there is one invalid elmement and an element just became invalid. // If we have invalid elements and we used to before as well, do nothing. if (mInvalidElementsCount && (mInvalidElementsCount != 1 || aElementValidity)) { return; } /* * We are going to update states assuming submit controls want to * be notified because we can't know. * UpdateValidity shouldn't be called so much during parsing so it _should_ * be safe. */ nsAutoScriptBlocker scriptBlocker; // Inform submit controls that the form validity has changed. for (uint32_t i = 0, length = mControls->mElements.Length(); i < length; ++i) { if (mControls->mElements[i]->IsSubmitControl()) { mControls->mElements[i]->UpdateState(true); } } // Because of backward compatibility, <input type='image'> is not in elements // so we have to check for controls not in elements too. uint32_t length = mControls->mNotInElements.Length(); for (uint32_t i = 0; i < length; ++i) { if (mControls->mNotInElements[i]->IsSubmitControl()) { mControls->mNotInElements[i]->UpdateState(true); } } UpdateState(true); } // nsIWebProgressListener NS_IMETHODIMP HTMLFormElement::OnStateChange(nsIWebProgress* aWebProgress, nsIRequest* aRequest, uint32_t aStateFlags, nsresult aStatus) { // If STATE_STOP is never fired for any reason (redirect? Failed state // change?) the form element will leak. It will be kept around by the // nsIWebProgressListener (assuming it keeps a strong pointer). We will // consequently leak the request. if (aRequest == mSubmittingRequest && aStateFlags & nsIWebProgressListener::STATE_STOP) { ForgetCurrentSubmission(); } return NS_OK; } NS_IMETHODIMP HTMLFormElement::OnProgressChange(nsIWebProgress* aWebProgress, nsIRequest* aRequest, int32_t aCurSelfProgress, int32_t aMaxSelfProgress, int32_t aCurTotalProgress, int32_t aMaxTotalProgress) { NS_NOTREACHED("notification excluded in AddProgressListener(...)"); return NS_OK; } NS_IMETHODIMP HTMLFormElement::OnLocationChange(nsIWebProgress* aWebProgress, nsIRequest* aRequest, nsIURI* location, uint32_t aFlags) { NS_NOTREACHED("notification excluded in AddProgressListener(...)"); return NS_OK; } NS_IMETHODIMP HTMLFormElement::OnStatusChange(nsIWebProgress* aWebProgress, nsIRequest* aRequest, nsresult aStatus, const char16_t* aMessage) { NS_NOTREACHED("notification excluded in AddProgressListener(...)"); return NS_OK; } NS_IMETHODIMP HTMLFormElement::OnSecurityChange(nsIWebProgress* aWebProgress, nsIRequest* aRequest, uint32_t state) { NS_NOTREACHED("notification excluded in AddProgressListener(...)"); return NS_OK; } NS_IMETHODIMP_(int32_t) HTMLFormElement::IndexOfControl(nsIFormControl* aControl) { int32_t index = 0; return mControls->IndexOfControl(aControl, &index) == NS_OK ? index : 0; } void HTMLFormElement::SetCurrentRadioButton(const nsAString& aName, HTMLInputElement* aRadio) { mSelectedRadioButtons.Put(aName, aRadio); } HTMLInputElement* HTMLFormElement::GetCurrentRadioButton(const nsAString& aName) { return mSelectedRadioButtons.GetWeak(aName); } NS_IMETHODIMP HTMLFormElement::GetNextRadioButton(const nsAString& aName, const bool aPrevious, HTMLInputElement* aFocusedRadio, HTMLInputElement** aRadioOut) { // Return the radio button relative to the focused radio button. // If no radio is focused, get the radio relative to the selected one. *aRadioOut = nullptr; RefPtr<HTMLInputElement> currentRadio; if (aFocusedRadio) { currentRadio = aFocusedRadio; } else { mSelectedRadioButtons.Get(aName, getter_AddRefs(currentRadio)); } nsCOMPtr<nsISupports> itemWithName = DoResolveName(aName, true); nsCOMPtr<nsINodeList> radioGroup(do_QueryInterface(itemWithName)); if (!radioGroup) { return NS_ERROR_FAILURE; } int32_t index = radioGroup->IndexOf(currentRadio); if (index < 0) { return NS_ERROR_FAILURE; } uint32_t numRadios; radioGroup->GetLength(&numRadios); RefPtr<HTMLInputElement> radio; bool isRadio = false; do { if (aPrevious) { if (--index < 0) { index = numRadios -1; } } else if (++index >= (int32_t)numRadios) { index = 0; } radio = HTMLInputElement::FromContentOrNull(radioGroup->Item(index)); isRadio = radio && radio->GetType() == NS_FORM_INPUT_RADIO; if (!isRadio) { continue; } nsAutoString name; radio->GetName(name); isRadio = aName.Equals(name); } while (!isRadio || (radio->Disabled() && radio != currentRadio)); NS_IF_ADDREF(*aRadioOut = radio); return NS_OK; } NS_IMETHODIMP HTMLFormElement::WalkRadioGroup(const nsAString& aName, nsIRadioVisitor* aVisitor, bool aFlushContent) { if (aName.IsEmpty()) { // // XXX If the name is empty, it's not stored in the control list. There // *must* be a more efficient way to do this. // nsCOMPtr<nsIFormControl> control; uint32_t len = GetElementCount(); for (uint32_t i = 0; i < len; i++) { control = GetElementAt(i); if (control->GetType() == NS_FORM_INPUT_RADIO) { nsCOMPtr<nsIContent> controlContent = do_QueryInterface(control); if (controlContent && controlContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::name, EmptyString(), eCaseMatters) && !aVisitor->Visit(control)) { break; } } } return NS_OK; } // Get the control / list of controls from the form using form["name"] nsCOMPtr<nsISupports> item = DoResolveName(aName, aFlushContent); if (!item) { return NS_ERROR_FAILURE; } // If it's just a lone radio button, then select it. nsCOMPtr<nsIFormControl> formControl = do_QueryInterface(item); if (formControl) { if (formControl->GetType() == NS_FORM_INPUT_RADIO) { aVisitor->Visit(formControl); } return NS_OK; } nsCOMPtr<nsIDOMNodeList> nodeList = do_QueryInterface(item); if (!nodeList) { return NS_OK; } uint32_t length = 0; nodeList->GetLength(&length); for (uint32_t i = 0; i < length; i++) { nsCOMPtr<nsIDOMNode> node; nodeList->Item(i, getter_AddRefs(node)); nsCOMPtr<nsIFormControl> formControl = do_QueryInterface(node); if (formControl && formControl->GetType() == NS_FORM_INPUT_RADIO && !aVisitor->Visit(formControl)) { break; } } return NS_OK; } void HTMLFormElement::AddToRadioGroup(const nsAString& aName, nsIFormControl* aRadio) { nsCOMPtr<nsIContent> element = do_QueryInterface(aRadio); NS_ASSERTION(element, "radio controls have to be content elements!"); if (element->HasAttr(kNameSpaceID_None, nsGkAtoms::required)) { mRequiredRadioButtonCounts.Put(aName, mRequiredRadioButtonCounts.Get(aName)+1); } } void HTMLFormElement::RemoveFromRadioGroup(const nsAString& aName, nsIFormControl* aRadio) { nsCOMPtr<nsIContent> element = do_QueryInterface(aRadio); NS_ASSERTION(element, "radio controls have to be content elements!"); if (element->HasAttr(kNameSpaceID_None, nsGkAtoms::required)) { uint32_t requiredNb = mRequiredRadioButtonCounts.Get(aName); NS_ASSERTION(requiredNb >= 1, "At least one radio button has to be required!"); if (requiredNb == 1) { mRequiredRadioButtonCounts.Remove(aName); } else { mRequiredRadioButtonCounts.Put(aName, requiredNb-1); } } } uint32_t HTMLFormElement::GetRequiredRadioCount(const nsAString& aName) const { return mRequiredRadioButtonCounts.Get(aName); } void HTMLFormElement::RadioRequiredWillChange(const nsAString& aName, bool aRequiredAdded) { if (aRequiredAdded) { mRequiredRadioButtonCounts.Put(aName, mRequiredRadioButtonCounts.Get(aName)+1); } else { uint32_t requiredNb = mRequiredRadioButtonCounts.Get(aName); NS_ASSERTION(requiredNb >= 1, "At least one radio button has to be required!"); if (requiredNb == 1) { mRequiredRadioButtonCounts.Remove(aName); } else { mRequiredRadioButtonCounts.Put(aName, requiredNb-1); } } } bool HTMLFormElement::GetValueMissingState(const nsAString& aName) const { return mValueMissingRadioGroups.Get(aName); } void HTMLFormElement::SetValueMissingState(const nsAString& aName, bool aValue) { mValueMissingRadioGroups.Put(aName, aValue); } EventStates HTMLFormElement::IntrinsicState() const { EventStates state = nsGenericHTMLElement::IntrinsicState(); if (mInvalidElementsCount) { state |= NS_EVENT_STATE_INVALID; } else { state |= NS_EVENT_STATE_VALID; } return state; } void HTMLFormElement::Clear() { for (int32_t i = mImageElements.Length() - 1; i >= 0; i--) { mImageElements[i]->ClearForm(false); } mImageElements.Clear(); mImageNameLookupTable.Clear(); mPastNameLookupTable.Clear(); } namespace { struct PositionComparator { nsIContent* const mElement; explicit PositionComparator(nsIContent* const aElement) : mElement(aElement) {} int operator()(nsIContent* aElement) const { if (mElement == aElement) { return 0; } if (nsContentUtils::PositionIsBefore(mElement, aElement)) { return -1; } return 1; } }; struct NodeListAdaptor { nsINodeList* const mList; explicit NodeListAdaptor(nsINodeList* aList) : mList(aList) {} nsIContent* operator[](size_t aIdx) const { return mList->Item(aIdx); } }; } // namespace nsresult HTMLFormElement::AddElementToTableInternal( nsInterfaceHashtable<nsStringHashKey,nsISupports>& aTable, nsIContent* aChild, const nsAString& aName) { nsCOMPtr<nsISupports> supports; aTable.Get(aName, getter_AddRefs(supports)); if (!supports) { // No entry found, add the element aTable.Put(aName, aChild); ++mExpandoAndGeneration.generation; } else { // Found something in the hash, check its type nsCOMPtr<nsIContent> content = do_QueryInterface(supports); if (content) { // Check if the new content is the same as the one we found in the // hash, if it is then we leave it in the hash as it is, this will // happen if a form control has both a name and an id with the same // value if (content == aChild) { return NS_OK; } // Found an element, create a list, add the element to the list and put // the list in the hash RadioNodeList *list = new RadioNodeList(this); // If an element has a @form, we can assume it *might* be able to not have // a parent and still be in the form. NS_ASSERTION(content->HasAttr(kNameSpaceID_None, nsGkAtoms::form) || content->GetParent(), "Item in list without parent"); // Determine the ordering between the new and old element. bool newFirst = nsContentUtils::PositionIsBefore(aChild, content); list->AppendElement(newFirst ? aChild : content.get()); list->AppendElement(newFirst ? content.get() : aChild); nsCOMPtr<nsISupports> listSupports = do_QueryObject(list); // Replace the element with the list. aTable.Put(aName, listSupports); } else { // There's already a list in the hash, add the child to the list nsCOMPtr<nsIDOMNodeList> nodeList = do_QueryInterface(supports); NS_ENSURE_TRUE(nodeList, NS_ERROR_FAILURE); // Upcast, uggly, but it works! RadioNodeList *list = static_cast<RadioNodeList*>(nodeList.get()); NS_ASSERTION(list->Length() > 1, "List should have been converted back to a single element"); // Fast-path appends; this check is ok even if the child is // already in the list, since if it tests true the child would // have come at the end of the list, and the PositionIsBefore // will test false. if (nsContentUtils::PositionIsBefore(list->Item(list->Length() - 1), aChild)) { list->AppendElement(aChild); return NS_OK; } // If a control has a name equal to its id, it could be in the // list already. if (list->IndexOf(aChild) != -1) { return NS_OK; } size_t idx; DebugOnly<bool> found = BinarySearchIf(NodeListAdaptor(list), 0, list->Length(), PositionComparator(aChild), &idx); MOZ_ASSERT(!found, "should not have found an element"); list->InsertElementAt(aChild, idx); } } return NS_OK; } nsresult HTMLFormElement::AddImageElement(HTMLImageElement* aChild) { AddElementToList(mImageElements, aChild, this); return NS_OK; } nsresult HTMLFormElement::AddImageElementToTable(HTMLImageElement* aChild, const nsAString& aName) { return AddElementToTableInternal(mImageNameLookupTable, aChild, aName); } nsresult HTMLFormElement::RemoveImageElement(HTMLImageElement* aChild) { size_t index = mImageElements.IndexOf(aChild); NS_ENSURE_STATE(index != mImageElements.NoIndex); mImageElements.RemoveElementAt(index); return NS_OK; } nsresult HTMLFormElement::RemoveImageElementFromTable(HTMLImageElement* aElement, const nsAString& aName, RemoveElementReason aRemoveReason) { // If the element is being removed from the form, we have to remove it from // the past names map. if (aRemoveReason == ElementRemoved) { for (auto iter = mPastNameLookupTable.Iter(); !iter.Done(); iter.Next()) { if (static_cast<void*>(aElement) == iter.Data()) { iter.Remove(); } } } return RemoveElementFromTableInternal(mImageNameLookupTable, aElement, aName); } void HTMLFormElement::AddToPastNamesMap(const nsAString& aName, nsISupports* aChild) { // If candidates contains exactly one node. Add a mapping from name to the // node in candidates in the form element's past names map, replacing the // previous entry with the same name, if any. nsCOMPtr<nsIContent> node = do_QueryInterface(aChild); if (node) { mPastNameLookupTable.Put(aName, aChild); } } JSObject* HTMLFormElement::WrapNode(JSContext* aCx, JS::Handle<JSObject*> aGivenProto) { return HTMLFormElementBinding::Wrap(aCx, this, aGivenProto); } } // namespace dom } // namespace mozilla