Firefox: Form submit over file protocol requires allowing entire file: protocol to work

Open pal1000 opened this issue 6 years ago • 0 comments

This should only require allowing the HTML document itself to work, but the part after submit only runs if entire file: protocol is allowed.

Testcase

<html><head><title>NoScript test of form submit over file protocol</title>
</head><body>

<script>
function $_GET(key, default_)
{
  if (default_==null) default_="";
  key = key.replace(/[\[]/,"\\\[").replace(/[\]]/,"\\\]");
  var regex = new RegExp("[\\?&]"+key+"=([^&#]*)");
  var qs = regex.exec(window.location.href);
  if(qs == null) qs=default_;
  else qs=qs[1];
  return qs;
}

function formsubmit(paramname, isfirst){
var sep='&';
if (isfirst == null) isfirst = false;
if (isfirst) sep='?';
return sep+paramname+'='+encodeURIComponent(document.getElementById(paramname).value);
}

var form="Enter some text:<input type='text' size='50' id='txt'/><br>"+
         "<input type='button' value='Submit' onclick='submit()'><br>";
if ($_GET('txt')=='') document.write(form);

function submit(){
var submitURL=window.location.protocol + '//' + window.location.hostname + window.location.pathname;
submitURL+=formsubmit('txt',true);
window.location=submitURL;
window.location;
}

if (!$_GET('txt')=='') document.write(decodeURIComponent($_GET('txt')));
</script>
</body></html>

Nov 16 '19 19:11 pal1000