Experiment with restricting form submission with open elements.

Experiment with restricting form submission with open elements.

HTML's parsing mechanism will automatically close form controls at the
end of a file. This is fine from a parsing perspective, but the behavior
does enable dangling markup attacks, such as those described in
http://www.thespanner.co.uk/2011/12/21/html-scriptless-attacks/ and
section 2 of http://lcamtuf.coredump.cx/postxss/.

Based on some discussion at https://github.com/whatwg/html/issues/2253,
this patch adds metrics to measure how often this happens in the wild
for `<textarea>` and `<select>` elements, and an experimental flag which
prevents form submission in the presence of those elements if they're
closed by reaching the end-of-file.

BUG=680462
Review-Url: https://codereview.chromium.org/2628723004
Cr-Commit-Position: refs/heads/master@{#443544}
Committed: https://chromium.googlesource.com/chromium/src/+/ab7a0ee9d3485c19da8b50af2d1cfc95fd6e4a98

[Mike West, 2017-01-12 12:00:47]

The CQ bit was checked by mkwst@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-01-12 12:00:57]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Mike West, 2017-01-12 12:02:03]

mkwst@chromium.org changed reviewers:
+ csharrison@chromium.org, jochen@chromium.org

[Mike West, 2017-01-12 12:02:04]

jochen@: WDYT of the experiment in general?

csharrison@: Would you mind evaluating the //core/html/parser bits specifically?

[jochen (gone - plz use gerrit), 2017-01-12 13:08:24]

lgtm

[Charlie Harrison, 2017-01-12 13:39:05]

parser lgtm

[commit-bot: I haz the power, 2017-01-12 13:50:26]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-01-12 13:50:27]

Dry run: Try jobs failed on following builders:
  win_chromium_rel_ng on master.tryserver.chromium.win (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.win/builders/win_chromium_rel_...)

[Mike West, 2017-01-12 15:15:50]

Description was changed from

==========
Experiment with restricting form submission with open elements.

HTML's parsing mechanism will automatically close form controls at the
end of a file. This is fine from a parsing perspective, but the behavior
does enable dangling markup attacks, such as those described in
http://www.thespanner.co.uk/2011/12/21/html-scriptless-attacks/ and
section 2 of http://lcamtuf.coredump.cx/postxss/.

This patch adds metrics to measure how often this happens in the wild,
and adds an experiment which changes the behavior to prevent form
submission in the presence of form control elements which were closed
by reaching the end-of-file.

BUG=680462
==========

to

==========
Experiment with restricting form submission with open elements.

HTML's parsing mechanism will automatically close form controls at the
end of a file. This is fine from a parsing perspective, but the behavior
does enable dangling markup attacks, such as those described in
http://www.thespanner.co.uk/2011/12/21/html-scriptless-attacks/ and
section 2 of http://lcamtuf.coredump.cx/postxss/.

Based on some discussion at https://github.com/whatwg/html/issues/2253,
this patch adds metrics to measure how often this happens in the wild
for `<textarea>` and `<select>` elements, adding an experiment which
prevents form submission in the presence of those elements if they're
closed by reaching the end-of-file.

BUG=680462
==========

[Mike West, 2017-01-12 15:23:18]

The CQ bit was checked by mkwst@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-01-12 15:23:52]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-01-12 16:21:02]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-01-12 16:21:02]

Dry run: Try jobs failed on following builders:
  linux_android_rel_ng on master.tryserver.chromium.android (JOB_FAILED,
https://build.chromium.org/p/tryserver.chromium.android/builders/linux_androi...)

[Mike West, 2017-01-13 08:12:19]

Description was changed from

==========
Experiment with restricting form submission with open elements.

HTML's parsing mechanism will automatically close form controls at the
end of a file. This is fine from a parsing perspective, but the behavior
does enable dangling markup attacks, such as those described in
http://www.thespanner.co.uk/2011/12/21/html-scriptless-attacks/ and
section 2 of http://lcamtuf.coredump.cx/postxss/.

Based on some discussion at https://github.com/whatwg/html/issues/2253,
this patch adds metrics to measure how often this happens in the wild
for `<textarea>` and `<select>` elements, adding an experiment which
prevents form submission in the presence of those elements if they're
closed by reaching the end-of-file.

BUG=680462
==========

to

==========
Experiment with restricting form submission with open elements.

HTML's parsing mechanism will automatically close form controls at the
end of a file. This is fine from a parsing perspective, but the behavior
does enable dangling markup attacks, such as those described in
http://www.thespanner.co.uk/2011/12/21/html-scriptless-attacks/ and
section 2 of http://lcamtuf.coredump.cx/postxss/.

Based on some discussion at https://github.com/whatwg/html/issues/2253,
this patch adds metrics to measure how often this happens in the wild
for `<textarea>` and `<select>` elements, and an experimental flag which
prevents form submission in the presence of those elements if they're
closed by reaching the end-of-file.

BUG=680462
==========

[Mike West, 2017-01-13 08:12:52]

The CQ bit was checked by mkwst@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-01-13 08:13:05]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Mike West, 2017-01-13 10:55:46]

The CQ bit was unchecked by mkwst@chromium.org

[Mike West, 2017-01-13 10:55:49]

The CQ bit was checked by mkwst@chromium.org

[Mike West, 2017-01-13 10:55:49]

The patchset sent to the CQ was uploaded after l-g-t-m from jochen@chromium.org,
csharrison@chromium.org
Link to the patchset: https://codereview.chromium.org/2628723004/#ps40001
(title: "s/invalid/error/")

[commit-bot: I haz the power, 2017-01-13 10:56:04]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-01-13 11:01:25]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-01-13 11:01:26]

Try jobs failed on following builders:
  chromium_presubmit on master.tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/chromium_presub...)

[Mike West, 2017-01-13 11:12:38]

The CQ bit was checked by mkwst@chromium.org

[Mike West, 2017-01-13 11:12:38]

The patchset sent to the CQ was uploaded after l-g-t-m from jochen@chromium.org,
csharrison@chromium.org
Link to the patchset: https://codereview.chromium.org/2628723004/#ps60001
(title: "Rebase.")

[commit-bot: I haz the power, 2017-01-13 11:12:56]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-01-13 13:30:46]

CQ is committing da patch.

Bot data: {"patchset_id": 60001, "attempt_start_ts": 1484305958473830,
"parent_rev": "994437489ea2c9aaf7fac316a90bf4dffeedf7b2", "commit_rev":
"ab7a0ee9d3485c19da8b50af2d1cfc95fd6e4a98"}

[commit-bot: I haz the power, 2017-01-13 13:31:21]

Description was changed from

==========
Experiment with restricting form submission with open elements.

HTML's parsing mechanism will automatically close form controls at the
end of a file. This is fine from a parsing perspective, but the behavior
does enable dangling markup attacks, such as those described in
http://www.thespanner.co.uk/2011/12/21/html-scriptless-attacks/ and
section 2 of http://lcamtuf.coredump.cx/postxss/.

Based on some discussion at https://github.com/whatwg/html/issues/2253,
this patch adds metrics to measure how often this happens in the wild
for `<textarea>` and `<select>` elements, and an experimental flag which
prevents form submission in the presence of those elements if they're
closed by reaching the end-of-file.

BUG=680462
==========

to

==========
Experiment with restricting form submission with open elements.

HTML's parsing mechanism will automatically close form controls at the
end of a file. This is fine from a parsing perspective, but the behavior
does enable dangling markup attacks, such as those described in
http://www.thespanner.co.uk/2011/12/21/html-scriptless-attacks/ and
section 2 of http://lcamtuf.coredump.cx/postxss/.

Based on some discussion at https://github.com/whatwg/html/issues/2253,
this patch adds metrics to measure how often this happens in the wild
for `<textarea>` and `<select>` elements, and an experimental flag which
prevents form submission in the presence of those elements if they're
closed by reaching the end-of-file.

BUG=680462

Review-Url: https://codereview.chromium.org/2628723004
Cr-Commit-Position: refs/heads/master@{#443544}
Committed:
https://chromium.googlesource.com/chromium/src/+/ab7a0ee9d3485c19da8b50af2d1c...
==========

[commit-bot: I haz the power, 2017-01-13 13:31:22]

Committed patchset #4 (id:60001) as
https://chromium.googlesource.com/chromium/src/+/ab7a0ee9d3485c19da8b50af2d1c...