Disable form elements in MHTML

third_party/WebKit/Source/web/WebFrameSerializer.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 67 matching lines @@
 class MHTMLFrameSerializerDelegate final : public FrameSerializer::Delegate {
   WTF_MAKE_NONCOPYABLE(MHTMLFrameSerializerDelegate);
 
  public:
   explicit MHTMLFrameSerializerDelegate(
       WebFrameSerializer::MHTMLPartsGenerationDelegate&);
   bool shouldIgnoreAttribute(const Element&, const Attribute&) override;
   bool rewriteLink(const Element&, String& rewrittenLink) override;
   bool shouldSkipResourceWithURL(const KURL&) override;
   bool shouldSkipResource(const Resource&) override;
+  Vector<Attribute> getCustomAttributes(const Element&) override;
 
  private:
   WebFrameSerializer::MHTMLPartsGenerationDelegate& m_webDelegate;
 };
 
 MHTMLFrameSerializerDelegate::MHTMLFrameSerializerDelegate(
     WebFrameSerializer::MHTMLPartsGenerationDelegate& webDelegate)
     : m_webDelegate(webDelegate) {}
 
 bool MHTMLFrameSerializerDelegate::shouldIgnoreAttribute(
@@ skipping 61 matching lines @@
 }
 
 bool MHTMLFrameSerializerDelegate::shouldSkipResource(
     const Resource& resource) {
   return m_webDelegate.cacheControlPolicy() ==
              WebFrameSerializerCacheControlPolicy::
                  SkipAnyFrameOrResourceMarkedNoStore &&
          resource.hasCacheControlNoStoreHeader();
 }
 
+Vector<Attribute> MHTMLFrameSerializerDelegate::getCustomAttributes(
+    const Element& element) {
+  Vector<Attribute> attributes;
+
+  // Disable all form elements in MTHML to tell the user that the form cannot be
+  // worked on. MHTML is loaded in full sandboxing mode which disable the form
+  // submission and script execution.
+  if (element.isFormControlElement() &&
+      !element.fastHasAttribute(HTMLNames::disabledAttr)) {
+    Attribute disabledAttribute(HTMLNames::disabledAttr, "");
+    attributes.append(disabledAttribute);
+  }
+
+  return attributes;
+}
+
 bool cacheControlNoStoreHeaderPresent(
     const WebLocalFrameImpl& webLocalFrameImpl) {
   const ResourceResponse& response =
       webLocalFrameImpl.dataSource()->response().toResourceResponse();
   if (response.cacheControlContainsNoStore())
     return true;
 
   const ResourceRequest& request =
       webLocalFrameImpl.dataSource()->request().toResourceRequest();
   return request.cacheControlContainsNoStore();
@@ skipping 144 matching lines @@
     const WebString& baseTarget) {
   // TODO(yosin) We should call |FrameSerializer::baseTagDeclarationOf()|.
   if (baseTarget.isEmpty())
     return String("<base href=\".\">");
   String baseString = "<base href=\".\" target=\"" +
                       static_cast<const String&>(baseTarget) + "\">";
   return baseString;
 }
 
 }  // namespace blink