Skip to content

template-require-form-method.md

Latest commit

 

History

History
55 lines (37 loc) · 1.77 KB

template-require-form-method.md

File metadata and controls

55 lines (37 loc) · 1.77 KB

ember/template-require-form-method

🔧 This rule is automatically fixable by the --fix CLI option.

This rule requires all <form> elements to have method attribute with POST, GET or DIALOG value.

By default form elements without method attribute are submitted as GET requests. In usual applications submit event listeners are attached to form elements and event.preventDefault() is called to avoid form submission.

However in case of failure to prevent default action, form submission as GET request can leak sensitive end-user information.

Example uses of GET requests:

  • non-secure data
  • bookmarking the submission result
  • data search query strings

Caution - this rules does not check for formmethod attribute on form elements themselves.

Examples

This rule forbids the following:

<template>
  <form>Hello world!</form>
  <form method=''></form>
  <form method='random'>Hello world!</form>
</template>

This rule allows the following:

<template>
  <form method='post'>Hello world!</form>
  <form method='get'>Hello world!</form>
  <form method='dialog'>Hello world!</form>
</template>

Configuration

The following values are valid configuration:

  • boolean - true to enable / false to disable
  • object -- An object with the following keys:
    • allowedMethods -- An array of allowed form method attribute values, default: ['POST', 'GET', 'DIALOG']

References