googlearchive / caja

Caja is a tool for safely embedding third party HTML, CSS and JavaScript in your website.
Apache License 2.0
1.13k stars 113 forks source link

Remove form onsubmit restriction. #2018

Closed kpreid closed 7 years ago

kpreid commented 7 years ago

The previous policy, of prohibiting any 'normal' form submit, was both stricter than the cajoler (ES5/3 mode) and silly, since it could be worked around in guest code with onsubmit='this.submit();'.