This is an archived snapshot of W3C's public bugzilla bug tracker, decommissioned in April 2019. Please see the home page for more details.

Bug 18481 - <form id="test"></form><button form="test" formaction="javascript:alert(1)">X</button>
Summary: <form id="test"></form><button form="test" formaction="javascript:alert(1)">X...
Status: RESOLVED WORKSFORME
Alias: None
Product: WHATWG
Classification: Unclassified
Component: HTML (show other bugs)
Version: unspecified
Hardware: Other other
: P3 normal
Target Milestone: Unsorted
Assignee: Ian 'Hixie' Hickson
QA Contact: contributor
URL: http://www.whatwg.org/specs/web-apps/...
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-08-03 09:03 UTC by contributor
Modified: 2012-10-08 22:33 UTC (History)
2 users (show)

See Also:

Attachments

Description contributor 2012-08-03 09:03:40 UTC 
Specification: http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html
Multipage: http://www.whatwg.org/C#the-form-element
Complete: http://www.whatwg.org/c#the-form-element

Comment:
<form id="test"></form><button form="test"
formaction="javascript:alert(1)">X</button>

Posted from: 182.48.112.66
User agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.60 Safari/537.1
Comment 1 Ian 'Hixie' Hickson 2012-10-08 22:33:23 UTC 
Yeah, that should work fine.