FormState::getTriggeringElement() behaves inconsistently when request is malformed

Created on 31 July 2024, 8 months ago

Problem/Motivation

By monitoring our logs, we noticed that some bots were triggering weird errors by sending malformed requests containing two triggering elements.

Steps to reproduce

1. Enabling the webform module
2. Create a webform containing a managed_file element and a captcha element
3. As an anonymous user, send a POST request simulating a click on both the file upload button and the webform submit button
4. The webform is submitted without validating the captcha

You can reproduce by sending a request like this where "op" is the submit button and "test_upload_button" is the upload button:

curl -X POST http://example.com/form/contact --data 'form_id=webform_submission_contact_add_form&foo=bar&op=Send message&test_upload_button=Upload'

If you monitor the value of FormState::getTriggeringElement() during the lifecycle of the form, you can notice its value is changing depending on when you check (for example it could be the upload button in a hook_form_alter and then later the submit button in a #process callback that runs later).

This seems to happen because, when a request has multiple triggering elements, FormState::setTriggeringElement() is called multiple times and replaces the previous element each time.
So the form state has a different triggering element depending on when you check.

Proposed resolution

I'm not sure there is a legitimate use case for allowing multiple triggering elements (browsers don't really allow sending requests like this) and the current behavior is confusing and can lead to bots triggering unexpected code paths.
Drupal should probably throw a BadRequestHttpException when multiple triggering elements are detected.

πŸ› Bug report
Status

Active

Version

10.3 ✨

Component
FormΒ  β†’

Last updated 26 minutes ago

Created by

πŸ‡«πŸ‡·France prudloff Lille

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Production build 0.71.5 2024