search

whatwg / html

HTML Standard
https://html.spec.whatwg.org/multipage/
Other
7.99k stars 2.61k forks source link

Remove FTP support, maybe tighten up form submission scheme list? #5375

Open domenic opened 4 years ago

domenic commented 4 years ago

It seems Chrome and Firefox are removing FTP support.

On the spec side, most of the work is in Fetch (https://github.com/whatwg/fetch/issues/1009). In HTML the only references I can find are in form submission step 22 and in the security considerations for the web+ scheme prefix.

Note that if we remove the form submission special case then the spec falls back to

If scheme is not one of those listed in this table, then the behavior is not defined by this specification. User agents should, in the absence of another specification defining this, act in a manner analogous to that defined in this specification for similar schemes.

This sentence makes me uneasy and I wonder if instead we can make the result fail somehow. (Maybe we just try to do a navigation, which fails once it hits the fetch layer.) This would require a bit of browser research.

annevk commented 4 years ago

Navigation wouldn't hit the fetch layer as navigation would dispatch to the OS for unknown schemes (we should consider limiting such dispatching to top-level navigations though). Such dispatch only uses the URL though I think so supporting POST might be a bit meaningless. Not sure if it's worth cleaning up.

annevk commented 3 years ago

When I wrote the above I didn't realize that ftp scheme form submission uses "Get action URL" for POST too.

A question I have is what browsers end up passing to zoom.us for

<form action=zoommtg:test><input type=text value=x name=x><input type=submit></form>

as both Chrome and Firefox end up launching it if you consent. Do they pass test or more? If they just pass test it seems that "Get action URL" would be the default and we can remove ftp and javascript from that table and clarify things a bit.